hitoshura25/cvefixes huggingface dataset:
CVE-2023-36813 (PHP, published 2023-07-05T22:15Z)
Description: value: Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality. It appears that in some insert and update operations, the code improperly uses the PicoDB library to update/insert new information. Version 1.2.31 contains a fix for this issue.

Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/kanboard/kanboard
Files changed:
libs/picodb/lib/PicoDb/Database.php
Commit message: Avoid potential SQL injections without breaking compatibility with plugins


Vulnerable code:

Fixed code:
use PicoDb\SQLException;
        // Avoid potential SQL injection
        if (preg_match('/^[a-z0-9_]+$/', $value) === 0) {
            throw new SQLException('Invalid identifier: '.$value);
        }
CVE-2024-36399 (PHP, published 2024-06-06T16:15Z)
Description: value: Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(). The users permission to add users to a project only get checked on the URL parameter project_id. If the user is authorized to add users to this project the request gets processed. The users permission for the POST BODY parameter project_id does not get checked again while processing. An attacker with the 'Project Manager' on a single project may take over any other project. The vulnerability is fixed in 1.2.37.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/kanboard/kanboard
Files changed:
app/Controller/ProjectPermissionController.php
app/Template/project_permission/groups.php
app/Template/project_permission/users.php
Commit message: Add CSRF check and remove project_id form value for addUser/addGroup actions


Vulnerable code:
        } elseif ($this->projectUserRoleModel->addUser($values['project_id'], $values['user_id'], $values['role'])) {
            <?= $this->form->hidden('project_id', array('project_id' => $project['id'])) ?>
            <?= $this->form->hidden('project_id', array('project_id' => $project['id'])) ?>

Fixed code:
        $this->checkCSRFForm();

        } elseif ($this->projectUserRoleModel->addUser($project['id'], $values['user_id'], $values['role'])) {
        $this->checkCSRFForm();
CVE-2017-8288 (JavaScript, published 2017-04-27T00:59Z)
Description: value: gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/GNOME/gnome-shell
Files changed:
js/ui/extensionSystem.js
Commit message: extensionSystem: handle reloading broken extensions

Some extensions out there may fail to reload. When that happens,
we need to catch any exceptions so that we don't leave things in
a broken state that could lead to leaving extensions enabled in
the screen shield.

https://bugzilla.gnome.org/show_bug.cgi?id=781728


Vulnerable code:
        reloadExtension(ExtensionUtils.extensions[uuid]);
            enableExtension(uuid);

Fixed code:
        try {
            reloadExtension(ExtensionUtils.extensions[uuid]);
        } catch(e) {
            logExtensionError(uuid, e);
        }
            try {
                enableExtension(uuid);
            } catch(e) {
                logExtensionError(uuid, e);
            }
CVE-2021-29511 (Rust, published 2021-05-12T18:15Z)
Description: value: evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use `evm_core::Memory::copy_large`, the `evm` crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The flaw was corrected in commit `19ade85`. Users should upgrade to `==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1`. There are no workarounds. Please upgrade your `evm` crate version.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/rust-blockchain/evm
Files changed:
core/src/memory.rs
Commit message: Skip setting memory value if the value vec is empty

Vulnerable code:

Fixed code:
		if value.is_empty() {
			return Ok(())
		}
CVE-2022-26691 (C, published 2022-05-26T18:15Z)
Description: value: A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.
Severity: HIGH (CVSS v3 base score: 6.7)
Weakness: CWE-697 \u2014 Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Repository: https://github.com/OpenPrinting/cups
Files changed:
CHANGES.md
scheduler/cert.c
Commit message: scheduler/cert.c: Fix string comparison (fixes CVE-2022-26691)

The previous algorithm didn't expect the strings can have a different
length, so one string can be a substring of the other and such substring
was reported as equal to the longer string.


Vulnerable code:
  return (result);

Fixed code:
- Fixed certificate strings comparison for Local authorization (CVE-2022-26691)
 /*
  * The while loop finishes when *a == '\0' or *b == '\0'
  * so after the while loop either both *a and *b == '\0',
  * or one points inside a string, so when we apply logical OR on *a,
  * *b and result, we get a non-zero return value if the compared strings don't match.
  */

  return (result | *a | *b);
CVE-2023-34241 (Unknown, published 2023-06-22T23:15Z)
Description: value: OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process.

The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`.

Version 2.4.6 has a patch for this issue.
Severity: nan (CVSS v3 base score: 7.1)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/OpenPrinting/cups
Files changed:
Commit message: Merge pull request from GHSA-qjgh-5hcq-5f25

Log result of httpGetHostname BEFORE closing the connection

Vulnerable code:

Fixed code:
CVE-2024-35235 (Unknown, published 2024-06-11T15:16Z)
Description: value: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/OpenPrinting/cups
Files changed:
Commit message: Merge pull request from GHSA-vvwp-mv6j-hw6f

Fix domain socket handling

Vulnerable code:

Fixed code:
CVE-2019-25072 (Go, published 2022-12-27T22:15Z)
Description: value: Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/tendermint/tendermint
Files changed:
rpc/lib/client/http_client.go
Commit message: rpc: client disable compression (#3430)



Vulnerable code:
			Dial: dialer,

Fixed code:
			// Set to true to prevent GZIP-bomb DoS attacks
			DisableCompression: true,
			Dial:               dialer,
CVE-2018-1002207 (Go, published 2018-07-25T17:29Z)
Description: value: mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/mholt/archiver
Files changed:
archiver.go
cmd/archiver/main.go
rar.go
tar.go
zip.go
Commit message: fix: prevent extraction of archived files outside target path (#65)

* fix: prevent extraction of archived files outside target path

* CR: consolidate the path sanitaiton logic


Vulnerable code:
		dest := ""
			err = mkdir(filepath.Join(destination, header.Name))
		err = mkdir(filepath.Dir(filepath.Join(destination, header.Name)))
		err = writeNewFile(filepath.Join(destination, header.Name), rr, header.Mode())
		return mkdir(filepath.Join(destination, header.Name))
		return writeNewFile(filepath.Join(destination, header.Name), tr, header.FileInfo().Mode())
		return writeNewSymbolicLink(filepath.Join(destination, header.Name), header.Linkname)
		return writeNewHardLink(filepath.Join(destination, header.Name), filepath.Join(destination, header.Linkname))

Fixed code:
	"strings"

func sanitizeExtractPath(filePath string, destination string) error {
	// to avoid zip slip (writing outside of the destination), we resolve
	// the target path, and make sure it's nested in the intended
	// destination, or bail otherwise.
	destpath := filepath.Join(destination, filePath)
	if !strings.HasPrefix(destpath, destination) {
		return fmt.Errorf("%s: illegal file path", filePath)
	}
	return nil
}
		dest, osErr := os.Getwd()
		if osErr != nil {
			fatal(err)
		}
		err = sanitizeExtractPath(header.Name, destination)
		if err != nil {
			return err
		}

		destpath := filepath.Join(destination, header.Name)

			err = mkdir(destpath)
		err = mkdir(filepath.Dir(destpath))
		err = writeNewFile(destpath, rr, header.Mode())
	err := sanitizeExtractPath(header.Name, destination)
	if err != nil {
		return err
	}

	destpath := filepath.Join(destination, header.Name)

		return mkdir(destpath)
		return writeNewFile(destpath, tr, header.FileInfo().Mode())
		return writeNewSymbolicLink(destpath, header.Linkname)
		return writeNewHardLink(destpath, filepath.Join(destination, header.Linkname))
	err := sanitizeExtractPath(zf.Name, destination)
	if err != nil {
		return err
	}
CVE-2024-40647 (Python, published 2024-07-18T17:15Z)
Description: value: sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the environment variables to be passed to subprocesses despite the `env={}` setting. In Python's `subprocess` calls, all environment variables are passed to subprocesses by default. However, if you specifically do not want them to be passed to subprocesses, you may use `env` argument in `subprocess` calls. Due to the bug in Sentry SDK, with the Stdlib integration enabled (which is enabled by default), this expectation is not fulfilled, and all environment variables are being passed to subprocesses instead. The issue has been patched in pull request #3251 and is included in sentry-sdk==2.8.0. We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing environment variables to child processes poses a security risk for you, you can disable all default integrations.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/getsentry/sentry-python
Files changed:
sentry_sdk/integrations/stdlib.py
tests/integrations/stdlib/test_subprocess.py
Commit message: fix(integrations): don't send full env to subprocess (#3251)

During the arguments modification to `subprocess.Popen.__init__`,
an explicitly empty environment of `{}` is incorrectly confused with a `None`
environment. This causes sentry to pass the entire environment of the
parent process instead of sending just the injected environment variables.

Fix it by only replacing the environment with `os.environ` if the variable
is None, and not just falsy.

---------

Co-authored-by: Kevin Michel <kevin.michel@aiven.io>

Vulnerable code:
                        a, kw, "env", 10, lambda x: dict(x or os.environ)

Fixed code:
                        a,
                        kw,
                        "env",
                        10,
                        lambda x: dict(x if x is not None else os.environ),
def test_subprocess_empty_env(sentry_init, monkeypatch):
    monkeypatch.setenv("TEST_MARKER", "should_not_be_seen")
    sentry_init(integrations=[StdlibIntegration()], traces_sample_rate=1.0)
    with start_transaction(name="foo"):
        args = [
            sys.executable,
            "-c",
            "import os; print(os.environ.get('TEST_MARKER', None))",
        ]
        output = subprocess.check_output(args, env={}, universal_newlines=True)
    assert "should_not_be_seen" not in output
CVE-2021-27185 (Unknown, published 2021-02-10T22:15Z)
Description: value: The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/eflexsystems/node-samba-client
Files changed:
Commit message: Merge pull request #36 from eflexsystems/v4



Vulnerable code:

Fixed code:
CVE-2019-20786 (Go, published 2020-04-19T20:15Z)
Description: value: handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/pion/dtls
Files changed:
conn.go
Commit message: Assert that ApplicationData has epoch != 0

Otherwise we may accept unencrypted/unauthenticated ApplicationData
from a remote


Vulnerable code:

Fixed code:
		if h.epoch == 0 {
			return &alert{alertLevelFatal, alertUnexpectedMessage}, fmt.Errorf("ApplicationData with epoch of 0")
		}
CVE-2022-29189 (Go, published 2022-05-21T00:15Z)
Description: value: Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could exploit this to cause excessive memory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/pion/dtls
Files changed:
errors.go
fragment_buffer.go
fragment_buffer_test.go
Commit message: Add limit to fragmentBuffer

Before we imposed no limit on the amount of data we would buffer during
the handshake. This changes adds a 2 megabyte. When the limit is
exceeded the Conn returns an error.


Vulnerable code:
			Name: "Multiple Handshakes in Signle Fragment",

Fixed code:
	errFragmentBufferOverflow            = &InternalError{Err: errors.New("fragment buffer overflow")}                        //nolint:goerr113
// 2 megabytes
const fragmentBufferMaxSize = 2000000

// current total size of buffer
func (f *fragmentBuffer) size() int {
	size := 0
	for i := range f.cache {
		for j := range f.cache[i] {
			size += len(f.cache[i][j].data)
		}
	}
	return size
}

	if f.size()+len(buf) >= fragmentBufferMaxSize {
		return false, errFragmentBufferOverflow
	}

	"errors"
			Name: "Multiple Handshakes in Single Fragment",

func TestFragmentBuffer_Overflow(t *testing.T) {
	fragmentBuffer := newFragmentBuffer()

	// Push a buffer that doesn't exceed size limits
	if _, err := fragmentBuffer.push([]byte{0x16, 0xfe, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0F, 0x03, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xfe, 0xff, 0x00}); err != nil {
		t.Fatal(err)
	}

	// Allocate a buffer that exceeds cache size
	largeBuffer := make([]byte, fragmentBufferMaxSize)
	if _, err := fragmentBuffer.push(largeBuffer); !errors.Is(err, errFragmentBufferOverflow) {
		t.Fatalf("Pushing a large buffer returned (%s) expected(%s)", err, errFragmentBufferOverflow)
	}
}
CVE-2022-29190 (Go, published 2022-05-21T00:15Z)
Description: value: Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/pion/dtls
Files changed:
fragment_buffer.go
fragment_buffer_test.go
Commit message: Don't attempt to append zero length fragments

Before the fragmentBuffer would process zero length fragments. Since
they are zero length the append would not do anything. This would
result in an infinite loop.


Vulnerable code:
				if fragmentEnd != f.handshakeHeader.Length {

Fixed code:
				if fragmentEnd != f.handshakeHeader.Length && f.handshakeHeader.FragmentLength != 0 {
		// Assert that a zero length fragment doesn't cause the fragmentBuffer to enter an infinite loop
		{
			Name: "Zero Length Fragment",
			In: [][]byte{
				{
					0x16, 0xfe, 0xfd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x00,
					0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
				},
			},
			Expected: [][]byte{
				{0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00},
			},
			Epoch: 0,
		},