hitoshura25/cvefixes huggingface dataset:
CVE-2020-14401 (C, published 2020-06-17T16:15Z)
Description: value: An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/LibVNC/libvncserver
Files changed:
libvncserver/scale.c
Commit message: libvncserver: scale: cast to 64 bit before shifting

Since pixel_value is 64 bit the data type of the shift operand should
be 64 bit too to prevent integer overflows.


Vulnerable code:
                 pixel_value += (srcptr2[z] << (8 * z));

Fixed code:
                 pixel_value += ((unsigned long)srcptr2[z] << (8 * z));
CVE-2020-14402 (C, published 2020-06-17T16:15Z)
Description: value: An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/LibVNC/libvncserver
Files changed:
libvncserver/corre.c
libvncserver/hextile.c
libvncserver/rre.c
Commit message: libvncserver: encodings: prevent OOB accesses


Vulnerable code:
            while ((seg[i] == cl) && (i < w)) i += 1;                         \
                    while ((seg[i] == cl2) && (i < w)) i += 1;                  \
            while ((seg[i] == cl) && (i < w)) i += 1;                         \

Fixed code:
            while ((i < w) && (seg[i] == cl)) i += 1;                         \
                    while ((i < w) && (seg[i] == cl2)) i += 1;                  \
            while ((i < w) && (seg[i] == cl)) i += 1;                         \
CVE-2020-14403 (C, published 2020-06-17T16:15Z)
Description: value: An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/LibVNC/libvncserver
Files changed:
libvncserver/corre.c
libvncserver/hextile.c
libvncserver/rre.c
Commit message: libvncserver: encodings: prevent OOB accesses


Vulnerable code:
            while ((seg[i] == cl) && (i < w)) i += 1;                         \
                    while ((seg[i] == cl2) && (i < w)) i += 1;                  \
            while ((seg[i] == cl) && (i < w)) i += 1;                         \

Fixed code:
            while ((i < w) && (seg[i] == cl)) i += 1;                         \
                    while ((i < w) && (seg[i] == cl2)) i += 1;                  \
            while ((i < w) && (seg[i] == cl)) i += 1;                         \
CVE-2020-14404 (C, published 2020-06-17T16:15Z)
Description: value: An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/LibVNC/libvncserver
Files changed:
libvncserver/corre.c
libvncserver/hextile.c
libvncserver/rre.c
Commit message: libvncserver: encodings: prevent OOB accesses


Vulnerable code:
            while ((seg[i] == cl) && (i < w)) i += 1;                         \
                    while ((seg[i] == cl2) && (i < w)) i += 1;                  \
            while ((seg[i] == cl) && (i < w)) i += 1;                         \

Fixed code:
            while ((i < w) && (seg[i] == cl)) i += 1;                         \
                    while ((i < w) && (seg[i] == cl2)) i += 1;                  \
            while ((i < w) && (seg[i] == cl)) i += 1;                         \
CVE-2020-14405 (C, published 2020-06-17T16:15Z)
Description: value: An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/LibVNC/libvncserver
Files changed:
libvncclient/rfbproto.c
Commit message: libvncclient/rfbproto: limit max textchat size

Addresses GitHub Security Lab (GHSL) Vulnerability Report
`GHSL-2020-063`.

Re #275


Vulnerable code:

Fixed code:
#define MAX_TEXTCHAT_SIZE 10485760 /* 10MB */
	  if(msg.tc.length > MAX_TEXTCHAT_SIZE)
	      return FALSE;
CVE-2020-29260 (C, published 2022-09-02T23:15Z)
Description: value: libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/LibVNC/libvncserver
Files changed:
libvncclient/vncviewer.c
Commit message: libvncclient: free vncRec memory in rfbClientCleanup()

Otherwise we leak memory. Spotted by Ramin Farajpour Cami
<ramin.blackhat@gmail.com>, thanks!


Vulnerable code:

Fixed code:
  free(client->vncRec);
CVE-2016-7145 (C, published 2017-03-07T15:59Z)
Description: value: The m_authenticate function in ircd/m_authenticate.c in nefarious2 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/evilnet/nefarious2
Files changed:
ircd/m_authenticate.c
Commit message: Fix to prevent SASL security vulnerability


Vulnerable code:

Fixed code:
      if (*parv[1] == ':' || strchr(parv[1], ' '))
		return exit_client(cptr, sptr, sptr, "Malformed AUTHENTICATE");
      if (*parv[1] == ':' || strchr(parv[1], ' '))
        return exit_client(cptr, sptr, sptr, "Malformed AUTHENTICATE");
CVE-2020-15093 (Unknown, published 2020-07-09T19:15Z)
Description: value: The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.
Severity: MEDIUM (CVSS v3 base score: 8.6)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/theupdateframework/tuf
Files changed:
Commit message: Merge pull request #974 from lukpueh/fix-signature-threshold

Fix signature threshold

Vulnerable code:

Fixed code:
CVE-2020-15163 (Unknown, published 2020-09-09T18:15Z)
Description: value: Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-345 \u2014 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Repository: https://github.com/theupdateframework/tuf
Files changed:
Commit message: Merge pull request #885 from trishankatdatadog:trishankatdatadog/correctly-rotate-root

Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>


Vulnerable code:

Fixed code:
CVE-2021-21307 (XML, published 2021-02-11T19:15Z)
Description: value: Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/lucee/Lucee
Files changed:
core/src/main/cfml/context/admin/Application.cfc
loader/build.xml
loader/pom.xml
Commit message: fixes LDEV-3119


Vulnerable code:
  <property name="version" value="5.3.8.88-SNAPSHOT"/>
  <version>5.3.8.88-SNAPSHOT</version>

Fixed code:
public function onRequestStart() {
	// if not logged in, we only allow access to admin|web|server[.cfm]
	if(!structKeyExists(session, "passwordWeb") && !structKeyExists(session, "passwordServer")){
		var fileName=listLast(cgi.script_name,"/");
		if(fileName!="admin.cfm" && fileName!="web.cfm" && fileName!="server.cfm") {
			cfheader(statuscode="404" statustext="Invalid access");
        	abort;
		}
	}
}

  <property name="version" value="5.3.8.89-SNAPSHOT"/>
  <version>5.3.8.89-SNAPSHOT</version>
CVE-2022-46179 (Python, published 2022-12-28T08:15Z)
Description: value: LiuOS is a small Python project meant to imitate the functions of a regular operating system. Version 0.1.0 and prior of LiuOS allow an attacker to set the GITHUB_ACTIONS environment variable to anything other than null or true and skip authentication checks. This issue is patched in the latest commit (c658b4f3e57258acf5f6207a90c2f2169698ae22) by requiring the var to be set to true, causing a test script to run instead of being able to login. A potential workaround is to check for the GITHUB_ACTIONS environment variable and set it to "" (no quotes) to null the variable and force credential checks.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/LiuWoodsCode/LiuOS
Files changed:
core.py
Commit message: Fix authentication bypass exploit

Fixes the exploit by setting the requirement of the var to true, causing a side effect of the tests running, not the shell, making the exploit useless.

Vulnerable code:
        if os.environ.get('GITHUB_ACTIONS') != "":

Fixed code:
        if os.environ.get('GITHUB_ACTIONS') == "true":
CVE-2021-25976 (Unknown, published 2021-11-16T09:15Z)
Description: value: In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/PiranhaCMS/piranha.core
Files changed:
Commit message: Merge pull request #1742 from PiranhaCMS/features/manager-security-update

Updated manager security. Fixes #1741

Vulnerable code:

Fixed code:
CVE-2019-14243 (Go, published 2019-07-23T22:15Z)
Description: value: headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attackers to cause a denial of service (webserver panic and daemon crash) via a crafted HAProxy PROXY v2 request with truncated source/destination address data.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/mastercactapus/proxyprotocol
Files changed:
headerv2.go
headerv2_test.go
parse_test.go
Commit message: Add test and fix for malformed/truncated header


Vulnerable code:
	if (rawHdr.FamProto >> 4) > 3 {
	if 16+int(rawHdr.Len) > len(buf) {
		newBuf := make([]byte, 16+int(rawHdr.Len))
		copy(newBuf, buf[:16])
		buf = newBuf
	} else {
		buf = buf[:16+int(rawHdr.Len)]
	}
			assert.NoError(t, err)

Fixed code:
	switch rawHdr.FamProto >> 4 {
	case 0: // local
		if rawHdr.Len != 0 {
			return nil, &InvalidHeaderErr{Read: buf[:16], error: errors.New("invalid length")}
		}
	case 1: // ipv4
		if rawHdr.Len != 12 {
			return nil, &InvalidHeaderErr{Read: buf[:16], error: errors.New("invalid length")}
		}
	case 2: // ipv6
		if rawHdr.Len != 36 {
			return nil, &InvalidHeaderErr{Read: buf[:16], error: errors.New("invalid length")}
		}
	case 3: // unix
		if rawHdr.Len != 216 {
			return nil, &InvalidHeaderErr{Read: buf[:16], error: errors.New("invalid length")}
		}
	default:
	buf = buf[:16+int(rawHdr.Len)]
			if !assert.NoError(t, err) {
				return
			}
package proxyprotocol

import (
	"bufio"
	"bytes"
	"testing"

	"github.com/stretchr/testify/assert"
)

func TestParse_Malformed(t *testing.T) {
	data := []byte{
		// PROXY protocol v2 magic header
		0x0D, 0x0A, 0x0D, 0x0A, 0x00, 0x0D, 0x0A, 0x51, 0x55, 0x49, 0x54, 0x0A,
		// v2 version, PROXY cmd
		0x21,
		// TCP, IPv4 (also works with 0x13,0x21,0x22,0x31,0x32)
		0x12,
		// Length
		0x00, 0x00,
		// src/dest address data _should_ be here but is omitted.
	}

	_, err := Parse(
		bufio.NewReader(
			bytes.NewReader(data)))
	assert.Error(t, err)
}
CVE-2018-18313 (C, published 2018-12-07T21:29Z)
Description: value: Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/Perl/perl5
Files changed:
regcomp.c
Commit message: regcomp.c: Convert some strchr to memchr

This allows things to work properly in the face of embedded NULs.
See the branch merge message for more information.


Vulnerable code:
    endbrace = strchr(RExC_parse, '}');
                char * endbrace;
                endbrace = strchr(RExC_parse, '}');
		    e = strchr(RExC_parse, '}');

Fixed code:
    endbrace = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse);
                char * endbrace = NULL;
                if (RExC_parse < RExC_end) {
                    endbrace = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse);
                }
		    e = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse);
CVE-2021-36770 (Perl, published 2021-08-11T23:15Z)
Description: value: Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-427 \u2014 Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Repository: https://github.com/Perl/perl5
Files changed:
cpan/Encode/Encode.pm
Commit message: Encode.pm: apply a local patch for CVE-2021-36770

I expect Encode to see a new release today.

Without this fix, Encode::ConfigLocal can be loaded from a path relative
to the current directory, because the || operator will evaluate @INC in
scalar context, putting an integer as the only value in @INC.


Vulnerable code:
    $VERSION = sprintf "%d.%02d", q$Revision: 3.10 $ =~ /(\d+)/g;
    local @INC = @INC || ();
    pop @INC if $INC[-1] eq '.';

Fixed code:
    $VERSION = "3.10_01";
    $VERSION = eval $VERSION;
    local @INC = @INC;
    pop @INC if @INC && $INC[-1] eq '.';
CVE-2020-36565 (Unknown, published 2022-12-07T17:15Z)
Description: value: Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/labstack/echo
Files changed:
Commit message: Merge pull request #1718 from little-cui/master

Fix static directory traversal security vulnerability for Windows

Vulnerable code:

Fixed code:
CVE-2021-4294 (Go, published 2022-12-28T17:15Z)
Description: value: A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.
Severity: nan (CVSS v3 base score: 5.9)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/openshift/osin
Files changed:
client.go
util.go
Commit message: Use constant time comparisons for client secrets

This is a precaution to avoid possible timing attacks on
client secrets.


Vulnerable code:
	return d.Secret == secret
		return client.GetSecret() == secret

Fixed code:
import "crypto/subtle"

	return subtle.ConstantTimeCompare([]byte(d.Secret), []byte(secret)) == 1
	"crypto/subtle"
		return subtle.ConstantTimeCompare([]byte(client.GetSecret()), []byte(secret)) == 1
CVE-2022-1053 (Python, published 2022-05-06T17:15Z)
Description: value: Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an AK of a software TPM. A successful attack breaks the entire chain of trust because a not validated AK is used by the verifier. This issue is worse if the validation happens first and then the agent gets added to the verifier because the timing is easier and the verifier does not validate the regcount entry being equal to 1,
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/keylime/keylime
Files changed:
keylime/cloud_verifier_tornado.py
keylime/tenant.py
Commit message: tenant, verifier: let the tenant provide the AK and mTLS certificate

This eliminates the need for the verifier to connect to the registrar.

Signed-off-by: Thore Sommer <mail@thson.de>


Vulnerable code:
from keylime import registrar_client
                    # We fetch the registrar data directly here because we require it for connecting to the agent
                    # using mTLS
                    registrar_client.init_client_tls('cloud_verifier')
                    registrar_data = registrar_client.getData(config.get("cloud_verifier", "registrar_ip"),
                                                              config.get("cloud_verifier", "registrar_port"), agent_id)
                    if registrar_data is None:
                        web_util.echo_json_response(self, 400,
                                                    f"Data for agent {agent_id} could not be found in registrar!")
                        logger.warning("Data for agent %s could not be found in registrar!", agent_id)
                        return

                    agent_data['mtls_cert'] = registrar_data.get('mtls_cert', None)
                    agent_data['ak_tpm'] = registrar_data['aik_tpm']

                    if registrar_data.get('mtls_cert', None) is None and agent_data['supported_version'] != "1.0":
                        mtls_cert = registrar_data.get('mtls_cert', None)

Fixed code:
                    agent_data['ak_tpm'] = json_body['ak_tpm']
                    agent_data['mtls_cert'] = json_body.get('mtls_cert', None)
                    if agent_data['mtls_cert'] is None and agent_data['supported_version'] != "1.0":
                        mtls_cert = agent_data['mtls_cert']
            'ak_tpm': self.registrar_data['aik_tpm'],
            'mtls_cert': self.registrar_data.get('mtls_cert', None),