hitoshura25/cvefixes huggingface dataset:
CVE-2013-6048 (Perl, published 2013-12-13T18:55Z)
Description: value: The get_group_tree function in lib/Munin/Master/HTMLConfig.pm in Munin before 2.0.18 allows remote nodes to cause a denial of service (infinite loop and memory consumption in the munin-html process) via crafted multigraph data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/munin-monitoring/munin
Files changed:
master/lib/Munin/Master/HTMLConfig.pm
Commit message: master: avoid an endless loop in HTML generation

Safeguard to avoid any bigger loop than 100 nested levels. It protects against
application bugs in the parsing code.

Thx Christoph Biedl (debian.axhn@manchmal.in-ulm.de) for noticing
and for providing a patch

Closes: C:CVE-2013-6048


Vulnerable code:

Fixed code:
                die ("Munin::Master::HTMLConfig ran into an endless loop") if ($counter >= 100);
            die ("Munin::Master::HTMLConfig ran into an endless loop") if ($counter >= 100);
            die ("Munin::Master::HTMLConfig ran into an endless loop") if ($counter >= 100);
CVE-2023-47163 (Python, published 2023-11-13T03:15Z)
Description: value: Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service (DoS) condition.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/remarshal-project/remarshal
Files changed:
pyproject.toml
remarshal.py
tests/lol.yml
tests/test_remarshal.py
Commit message: fix(yaml): limit maximum nodes

Prevent a billion laughs attack carried out with YAML anchors.

Thanks to Taichi Kotake of Akatsuki Inc. for finding this vulnerability
and to JPCERT/CC for reporting it.

JVN#86156389


Vulnerable code:
version = "0.17.0"
max-args = 11
max-branches = 19
__version__ = "0.17.0"
    except (OSError, TypeError, ValueError) as e:

Fixed code:
version = "0.17.1"
max-args = 12
max-branches = 20
max-statements = 100
__version__ = "0.17.1"
DEFAULT_MAX_NODES = 100000
    parser.add_argument(
        "--max-nodes",
        dest="max_nodes",
        metavar="n",
        type=int,
        default=DEFAULT_MAX_NODES,
        help="maximum number of nodes in input data (default %(default)s)",
    )

class TooManyNodesError(BaseException):
    def __init__(self, msg: str = "document has too many nodes", *args, **kwargs):
        super().__init__(msg, *args, **kwargs)


def validate_node_count(doc: Document, *, limit: int) -> None:
    count = 0

    def count_callback(x: Any) -> Any:
        nonlocal count
        nonlocal limit

        count += 1
        if count > limit:
            raise TooManyNodesError

        return x

    traverse(doc, instance_callbacks={(object, count_callback)})


        max_nodes=args.max_nodes,
    max_nodes: int = DEFAULT_MAX_NODES,
        validate_node_count(parsed, limit=max_nodes)

    except (OSError, TooManyNodesError, TypeError, ValueError) as e:
lol1: &lol1 "lol" 
lol2: &lol2 [*lol1,*lol1,*lol1,*lol1,*lol1,*lol1,*lol1,*lol1,*lol1] 
lol3: &lol3 [*lol2,*lol2,*lol2,*lol2,*lol2,*lol2,*lol2,*lol2,*lol2]
lol4: &lol4 [*lol3,*lol3,*lol3,*lol3,*lol3,*lol3,*lol3,*lol3,*lol3]
lol5: &lol5 [*lol4,*lol4,*lol4,*lol4,*lol4,*lol4,*lol4,*lol4,*lol4]
lol6: &lol6 [*lol5,*lol5,*lol5,*lol5,*lol5,*lol5,*lol5,*lol5,*lol5]
lol7: &lol7 [*lol6,*lol6,*lol6,*lol6,*lol6,*lol6,*lol6,*lol6,*lol6]
lol8: &lol8 [*lol7,*lol7,*lol7,*lol7,*lol7,*lol7,*lol7,*lol7,*lol7]
lol9: &lol9 [*lol8,*lol8,*lol8,*lol8,*lol8,*lol8,*lol8,*lol8,*lol8]
lol10: &lol10 [*lol9,*lol9,*lol9,*lol9,*lol9,*lol9,*lol9,*lol9,*lol9]

    def test_yaml_billion_laughs(self) -> None:
        with pytest.raises(remarshal.TooManyNodesError):
            self.convert_and_read("lol.yml", "yaml", "json")
CVE-2024-39900 (Kotlin, published 2024-07-09T22:15Z)
Description: value: OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/opensearch-project/reporting
Files changed:
README.md
src/main/kotlin/org/opensearch/reportsscheduler/security/UserAccessManager.kt
Commit message: tenancy access control (#992) (#993)

* Check user name for private tenant access control



* fix broken link



---------


(cherry picked from commit 99f02f3745d7e9a88c144b3f2cba000e153bfd07)

Signed-off-by: Sean Kao <seankao@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Vulnerable code:
[reports-scheduler-it-code-link]: https://github.com/opensearch-project/dashboards-reports/blob/main/reports-scheduler/src/test/kotlin/org/opensearch/reportsscheduler/ReportsSchedulerPluginIT.kt

Fixed code:
[reports-scheduler-it-code-link]: https://github.com/opensearch-project/reporting/blob/main/src/test/kotlin/org/opensearch/integTest/ReportsSchedulerPluginIT.kt
        if (isUserPrivateTenant(user)) {
            return access.contains("$USER_TAG${user.name}")
        }
CVE-2019-16764 (Other, published 2019-11-25T17:15Z)
Description: value: The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is fetched from the user provided params, and `String.to_atom/1` is used to convert the binary value to an atom so it can be used to fetch the provider configuration value. This is unsafe as it is user provided data, and can be used to fill up the whole atom table of ~1M which will cause the app to crash.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pow-auth/pow_assent
Files changed:
CHANGELOG.md
lib/pow_assent/config.ex
lib/pow_assent/plug.ex
test/pow_assent/config_test.exs
Commit message: Prevent `String.to_atom/1` calls


Vulnerable code:
  @spec get_provider_config(t(), atom()) :: t() | no_return
    |> get(provider)
    |> Enum.map(&String.to_atom(&1.provider))
    provider        = String.to_atom(provider)

Fixed code:
## v0.4.4 (TBA)

* [`PowAssent.Plug`] Now uses `String.to_existing_atom/1` in `PowAssent.Plug.providers_for_current_user/1`
* [`PowAssent.Plug`] Fixed security issue by removing `String.to_atom/1` for user provided binary in `PowAssent.Plug.authorize_url/3` and `PowAssent.Plug.callback/4`
* [`PowAssent.Config`] `PowAssent.Config.get_provider_config/2` now accepts binary provider

  @spec get_provider_config(t(), atom() | binary()) :: t() | no_return
    |> get_for_provider(provider)
  defp get_for_provider(providers_config, provider) when is_atom(provider) do
    get(providers_config, provider)
  end
  defp get_for_provider(providers_config, provider) when is_binary(provider) do
    Enum.find_value(providers_config, fn {key, value} ->
      case Atom.to_string(key) do
        ^provider -> value
        _any      -> false
      end
    end)
  end

    |> Enum.map(&String.to_existing_atom(&1.provider))

  test "get_provider_config/2 with binary provider" do
    config = [providers: [provider1: [a: 1], provider2: [b: 2]]]

    assert Config.get_provider_config(config, "provider1") == [a: 1]

    assert_raise PowAssent.Config.ConfigError, "No provider configuration available for non_existent.", fn ->
      refute Config.get_provider_config(config, "non_existent")
    end
  end
CVE-2017-1000414 (C++, published 2018-01-25T16:29Z)
Description: value: ImpulseAdventure JPEGsnoop version 1.7.5 is vulnerable to a division by zero in the JFIF decode handling resulting denial of service.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/ImpulseAdventure/JPEGsnoop
Files changed:
JfifDecode.cpp
Commit message: Fixed div0 vulnerability in SampFact


Vulnerable code:
// Copyright (C) 2015 - Calvin Hass
			//if (!ValidateValue(m_anSofHorzSampFact_Hi[nCompIdent],1,4,_T("Horizontal Sampling Factor <Hi>"),true,1)) return DECMARK_ERR;
			//if (!ValidateValue(m_anSofVertSampFact_Vi[nCompIdent],1,4,_T("Vertical Sampling Factor <Vi>"),true,1)) return DECMARK_ERR;

Fixed code:
// Copyright (C) 2017 - Calvin Hass
			if (!ValidateValue(m_anSofHorzSampFact_Hi[nCompIdent],1,4,_T("Horizontal Sampling Factor <Hi>"),true,1)) return DECMARK_ERR;
			if (!ValidateValue(m_anSofVertSampFact_Vi[nCompIdent],1,4,_T("Vertical Sampling Factor <Vi>"),true,1)) return DECMARK_ERR;
CVE-2018-3719 (JavaScript, published 2018-06-07T02:29Z)
Description: value: mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/jonschlinkert/mixin-deep
Files changed:
index.js
Commit message: exclude __proto__


Vulnerable code:

Fixed code:
  if (key === '__proto__') {
    return;
  }
CVE-2020-27209 (C, published 2021-05-20T21:15Z)
Description: value: The ECDSA operation of the micro-ecc library 1.0 is vulnerable to simple power analysis attacks which allows an adversary to extract the private ECC key.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/kmackay/micro-ecc
Files changed:
uECC.c
Commit message: Fix for #168


Vulnerable code:
#endif    
    EccPoint_mult(p, curve->G, k2[!carry], 0, num_n_bits + 1, curve);
#endif    
#endif    

Fixed code:
#endif
    uECC_word_t *initial_Z = 0;
    /* If an RNG function was specified, try to get a random initial Z value to improve
       protection against side-channel attacks. */
    if (g_rng_function) {
        if (!uECC_generate_random_int(k2[carry], curve->p, num_words)) {
            return 0;
        }
        initial_Z = k2[carry];
    }
    EccPoint_mult(p, curve->G, k2[!carry], initial_Z, num_n_bits + 1, curve);
#endif
#endif
CVE-2023-42456 (Unknown, published 2023-09-21T16:15Z)
Description: value: Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout has passed will the user have to re-authenticate themselves. Supporting this functionality is a set of session files (timestamps) for each user, stored in `/var/run/sudo-rs/ts`. These files are named according to the username from which the sudo attempt is made (the origin user).

An issue was discovered in versions prior to 0.2.1 where usernames containing the `.` and `/` characters could result in the corruption of specific files on the filesystem. As usernames are generally not limited by the characters they can contain, a username appearing to be a relative path can be constructed. For example we could add a user to the system containing the username `../../../../bin/cp`. When logged in as a user with that name, that user could run `sudo -K` to clear their session record file. The session code then constructs the path to the session file by concatenating the username to the session file storage directory, resulting in a resolved path of `/bin/cp`. The code then clears that file, resulting in the `cp` binary effectively being removed from the system.

An attacker needs to be able to login as a user with a constructed username. Given that such a username is unlikely to exist on an existing system, they will also need to be able to create the users with the constructed usernames.

The issue is patched in version 0.2.1 of sudo-rs. Sudo-rs now uses the uid for the user instead of their username for determining the filename. Note that an upgrade to this version will result in existing session files being ignored and users will be forced to re-authenticate. It also fully eliminates any possibility of path traversal, given that uids are always integer values.

The `sudo -K` and `sudo -k` commands can run, even if a user has no sudo access. As a workaround, make sure that one's system does not contain any users with a specially crafted username. While this is the case and while untrusted users do not have the ability to create arbitrary users on the system, one should not be able to exploit this issue.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/memorysafety/sudo-rs
Files changed:
Commit message: Merge pull request from GHSA-2r3c-m6v7-9354

Use uid instead of username for storing session files

Vulnerable code:

Fixed code:
CVE-2023-42456 (Unknown, published 2023-09-21T16:15Z)
Description: value: Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout has passed will the user have to re-authenticate themselves. Supporting this functionality is a set of session files (timestamps) for each user, stored in `/var/run/sudo-rs/ts`. These files are named according to the username from which the sudo attempt is made (the origin user).

An issue was discovered in versions prior to 0.2.1 where usernames containing the `.` and `/` characters could result in the corruption of specific files on the filesystem. As usernames are generally not limited by the characters they can contain, a username appearing to be a relative path can be constructed. For example we could add a user to the system containing the username `../../../../bin/cp`. When logged in as a user with that name, that user could run `sudo -K` to clear their session record file. The session code then constructs the path to the session file by concatenating the username to the session file storage directory, resulting in a resolved path of `/bin/cp`. The code then clears that file, resulting in the `cp` binary effectively being removed from the system.

An attacker needs to be able to login as a user with a constructed username. Given that such a username is unlikely to exist on an existing system, they will also need to be able to create the users with the constructed usernames.

The issue is patched in version 0.2.1 of sudo-rs. Sudo-rs now uses the uid for the user instead of their username for determining the filename. Note that an upgrade to this version will result in existing session files being ignored and users will be forced to re-authenticate. It also fully eliminates any possibility of path traversal, given that uids are always integer values.

The `sudo -K` and `sudo -k` commands can run, even if a user has no sudo access. As a workaround, make sure that one's system does not contain any users with a specially crafted username. While this is the case and while untrusted users do not have the ability to create arbitrary users on the system, one should not be able to exploit this issue.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-23 \u2014 Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
Repository: https://github.com/memorysafety/sudo-rs
Files changed:
Commit message: Merge pull request from GHSA-2r3c-m6v7-9354

Use uid instead of username for storing session files

Vulnerable code:

Fixed code:
CVE-2021-32837 (Python, published 2023-01-17T22:15Z)
Description: value: mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of service (ReDoS) prior to version 0.4.6. If a web server responds in a malicious way, then mechanize could crash. Version 0.4.6 has a patch for the issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/python-mechanize/mechanize
Files changed:
mechanize/_urllib2_fork.py
test/test_urllib2.py
Commit message: Use the current upstream (python3.9) authreq header parsing regex

Fixes a DoS when parsing a malformed auth header. Reported by CodeQL.
Reference GHSL-2021-108


Vulnerable code:
    rx = re.compile('(?:.*,)*[ \t]*([^ \t]+)[ \t]+'
                    'realm=(["\'])(.*?)\\2', re.I)
from mechanize._urllib2_fork import AbstractHTTPHandler, normalize_url

Fixed code:
    rx = re.compile('(?:^|,)'     # start of the string or ','
                    '[ \t]*'      # optional whitespaces
                    '([^ \t,]+)'  # scheme like "Basic"
                    '[ \t]+'      # mandatory whitespaces
                    # realm=xxx
                    # realm='xxx'
                    # realm="xxx"
                    'realm=(["\']?)([^"\']*)\\2',
                    re.I)
from mechanize._urllib2_fork import AbstractHTTPHandler, normalize_url, AbstractBasicAuthHandler
    def test_parse_authreq(self):
        for bad in (",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,",):
            self.assertIsNone(AbstractBasicAuthHandler.rx.search(bad))
CVE-2022-4121 (C, published 2023-01-17T18:15Z)
Description: value: In libetpan a null pointer dereference in mailimap_mailbox_data_status_free in low-level/imap/mailimap_types.c was found that could lead to a remote denial of service or other potential consequences.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/dinhvh/libetpan
Files changed:
src/low-level/imap/mailimap_types.c
Commit message: Fixed crash when st_info_list is NULL. Fixes #420. Fixes CVE-2022-4121.


Vulnerable code:
  clist_foreach(info->st_info_list, (clist_func) mailimap_status_info_free,
		 NULL);
  clist_free(info->st_info_list);

Fixed code:
  if (info->st_info_list != NULL) {
    clist_foreach(info->st_info_list, (clist_func) mailimap_status_info_free,
      NULL);
    clist_free(info->st_info_list);
  }
CVE-2014-125038 (Other, published 2023-01-02T18:15Z)
Description: value: A vulnerability has been found in IS_Projecto2 and classified as critical. This vulnerability affects unknown code of the file Cnn-EJB/ejbModule/ejbs/NewsBean.java. The manipulation of the argument date leads to sql injection. The name of the patch is aa128b2c9c9fdcbbf5ecd82c1e92103573017fe0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217192.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/rfsimoes/IS_Projecto2
Files changed:
Cnn-EJB/ejbModule/ejbs/NewsBean.java
Cnn-Web/WebContent/AllNews.jsp
Cnn-Web/WebContent/DateNews.jsp
Cnn-Web/WebContent/Menu.jsp
Commit message: data a funcionar mas sem proteger sql injection


Vulnerable code:
    	Query query = em.createQuery("SELECT n FROM News n WHERE n.date > :d ORDER BY date DESC");
    	query.setParameter("d", date);
    	Query query = em.createQuery("SELECT n FROM News n WHERE n.region LIKE :r AND n.date > :d ORDER BY date DESC");
    	query.setParameter("d", date);
									<c:set var="string2" value="This is second String."/>
									<c:set var="numAuthors" value="${fn:length(string2)}"/>
									<p>Length of String (2) : ${numAuthors}</p>
									 -->
					List news more recent than <input type="text" name="date" id="date" />

Fixed code:
    	Query query = em.createQuery("SELECT n FROM News n WHERE n.date > '"+date+"' ORDER BY date DESC");
    	//query.setParameter("d", date);
    	Query query = em.createQuery("SELECT n FROM News n WHERE n.region LIKE :r AND n.date > '"+date+"' ORDER BY date DESC");
    	//query.setParameter("d", date);
									-->
			//System.out.println("DATA: " + date);
					List news more recent than <input type="datetime-local" name="date" id="date" />
CVE-2018-13863 (JavaScript, published 2018-07-10T20:29Z)
Description: value: The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mongodb/js-bson
Files changed:
lib/bson/decimal128.js
Commit message: fix(decimal128): add basic guard against REDOS attacks

This is a naive approach to reducing the efficacy of a REDOS attack
against this module. A refactor of the regular expression or a
custom parser substitute would be ideal, however this solution
suffices as a stopgap until such work is completed.

Many thanks to James Davis who graciously alterted us to the
attack


Vulnerable code:

Fixed code:
  // Naively prevent against REDOS attacks.
  // TODO: implementing a custom parsing for this, or refactoring the regex would yield
  //       further gains.
  if (string.length >= 7000) {
    throw new Error('' + string + ' not a valid Decimal128 string');
  }