huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2021-3807: nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes
Component: nodejs-ansi-regex
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-09-17T00:00:00+00:00

A regular expression denial of service (ReDoS) vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes.

Statement: This flaw requires crafted invalid ANSI escape codes in order to be exploited and only allows for denial of service of applications on the client side, hence the impact has been rated as Moderate.

In Red Hat Virtualization and Red Hat Quay some components use a vulnerable version of ansi-regex. However, all frontend code is executed on the client side. As the maximum impact of this vulnerability is denial of service in the client, the vulnerability is rated Moderate for those products.

OpenShift Container Platform 4 (OCP) ships affected version of ansi-regex in the ose-metering-hadoop container, however the metering operator is deprecated since 4.6[1]. This issue is not currently planned to be addressed in future updates and hence hadoop container has been marked as 'will not fix'.

Advanced Cluster Management for Kubernetes (RHACM) ships the affected version of ansi-regex in several containers, however the impact of this vulnerability is deemed low as it would result in an authenticated slowing down their own user interface. 

[1] https://docs.openshift.com/container-platform/4.6/metering/metering-about-metering.html

Affected upstream versions: unspecified < 6.0.1, unspecified < 5.0.1
Fixed upstream versions: 5.0.1, 6.0.1
Upstream repository: https://github.com/chalk/ansi-regex
Upstream fix commit: 8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9
CVE-2021-38185: cpio: integer overflow in ds_fgetstr() in dstring.c can lead to an out-of-bounds write via a crafted pattern file
Component: cpio
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2021-08-06T00:00:00+00:00

A flaw was found in cpio. An integer overflow that triggers an out-of-bounds heap write can allow an attacker to execute arbitrary code via a crafted pattern file. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: cpio on Red Hat Enterprise Linux 8 is compiled with full RELRO, which mitigates the exploitation technique demonstrated in the report. Additionally, this requires the use of an unusual set of parameters.

Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/cpio.git
Upstream fix commit: dd96882877721703e19272fe25034560b794061b
CVE-2021-38201: kernel: slab-out-of-bounds access in xdr_set_page_base() in net/sunrpc/xdr.c
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-06-13T00:00:00+00:00

A flaw was found in the Linux kernel that allows remote attackers to cause a denial of service (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations. The highest threat from this vulnerability is to system availability.

Statement: This issue only affects the Linux kernel versions as shipped with Red Hat Enterprise Linux 8.4 GA onwards.

Affected upstream versions: n/a
Fixed upstream versions: v5.14
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 6d1c0f3d28f98ea2736128ed3e46821496dc3a8c
CVE-2021-3826: libiberty: Heap/stack buffer overflow in the dlang_lname function in d-demangle.c
Component: libiberty
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2021-09-22T00:00:00+00:00

A vulnerability was found in Libiberty. A heap and stack buffer overflow found in the dlang_lname function in d-demangle.c leads to a denial of service.

Statement: Libiberty is a component used during compilation. This vulnerability requires a corrupted input file to have already been introduced into your application’s source code. This flaw could then induce a segmentation fault during compile time. However, it would be immediately apparent to the developer or operations team that something is wrong.

In a release pipeline which utilizes libiberty, a build failure would not prevent usage of existing stable builds, so while a flaw of this type could halt the roll out of new versions of your app, it cannot impact any apps which have already been built and deployed.

If this vulnerability were exploited, organizations which follow basic industry guidance for development and security (isolation of build environment, use of version control, and restriction of commit access) would be able to recover easily. Better prepared organizations would not even experience an outage as any problematic commits would be automatically reverted. For these reasons Red Hat Product Security has rated the impact as Low.

Affected upstream versions: gcc 11.2.0
Upstream repository: https://gcc.gnu.org/git/gcc.git
Upstream fix commit: 5481040197402be6dfee265bd2ff5a4c88e30505
CVE-2021-3827: keycloak-server-spi-private: ECP SAML binding bypasses authentication flows
Component: keycloak-server-spi-private
Severity: Moderate
CWE: CWE-287 (Improper Authentication)
CVSS v3: 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2021-09-02T00:00:00+00:00

A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.


Affected upstream versions: Fixed in v18.0.0
Fixed upstream versions: 18.0.0
Upstream repository: https://github.com/keycloak/keycloak
Upstream fix commit: 44000caaf5051d7f218d1ad79573bd3d175cad0d
CVE-2021-3839: DPDK: out-of-bounds read/write in vhost_user_set_inflight_fd() may lead to crash
Component: DPDK
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-04-29T00:00:00+00:00

A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.

Statement: This flaw does not affect Red Hat Ceph Storage 3 and 4 as dpdk (embedded in ceph source rpm) is not built in the packages, therefore the vulnerable code is not available in the resulting RPM and the issue cannot be exploited.

Affected upstream versions: Fixed in dpdk v22.03
Fixed upstream versions: v22.03
Upstream repository: https://github.com/DPDK/dpdk
Upstream fix commit: 6442c329b9d2ded0f44b27d2016aaba8ba5844c5
CVE-2021-3856: keycloak-services: ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader
Component: keycloak-services
Severity: Low
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2021-10-04T00:00:00+00:00

ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.


Affected upstream versions: Fixed in 15.1.0
Fixed upstream versions: 15.1.0
Upstream repository: https://github.com/keycloak/keycloak
Upstream fix commit: 73f0474008e1bebd0733e62a22aceda9e5de6743
CVE-2021-3859: undertow: client side invocation timeout raised when calling over HTTP2
Component: undertow
Severity: Important
CWE: CWE-214 (Invocation of Process Using Visible Sensitive Information)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-02-01T00:00:00+00:00

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.

Statement: Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Critical flaws.

Affected upstream versions: Fixed in 2.2.15.Final
Fixed upstream versions: 2.2.15.Final
Upstream repository: https://github.com/undertow-io/undertow
Upstream fix commit: e43f0ada3f4da6e8579e0020cec3cb1a81e487c2
CVE-2021-38593: qt: out-of-bounds write in QOutlineMapper::convertPath called from QRasterPaintEngine::fill and QPaintEngineEx::stroke
Component: qt
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-07-27T00:00:00+00:00

A vulnerability was found in Qt, where an out-of-bounds write in the QOutlineMapper::convertPath function can lead to a denial of service, a remote attacker could exploit this flaw by sending a specially crafted request, causing the application to crash.

Statement: This vulnerability is rated as moderate because it allows a remote attacker to trigger a denial of service through an out-of-bounds write, exploiting this flaw could crash the application, impacting availability but not compromising system security or integrity.

Affected upstream versions: n/a
Fixed upstream versions: v6.3.0
Upstream repository: https://github.com/qt/qtbase
Upstream fix commit: 6b400e3147dcfd8cc3a393ace1bd118c93762e0c
CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() in drawscreen.c
Component: vim
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Public date: 2021-10-07T00:00:00+00:00

An out-of-bounds write flaw was found in vim's drawscreen.c win_redr_status() function. This flaw allows an attacker to trick a user to open a crafted file with specific arguments in vim, triggering an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.

Statement: This flaw is out of support scope for vim as shipped in Red Hat Enterprise Linux 6 and 7. For more comprehensive information about Red Hat Enterprise Linux support scope, please see https://access.redhat.com/support/policy/updates/errata/

Affected upstream versions: unspecified < 8.2.3487
Fixed upstream versions: 8.2.3487
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 826bfe4bbd7594188e3d74d2539d9707b1c6a14b
CVE-2021-3903: vim: heap-based buffer overflow vulnerability
Component: vim
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2021-10-24T00:00:00+00:00

vim is vulnerable to Heap-based Buffer Overflow

Statement: This flaw is marked as Low Impact because it requires a user to run an untrusted/malicious Vim script using the `-s` option at the command line. Untrusted Vim scripts should never be run as they can already execute arbitrary shell commands. The security issue raised by this flaw would be no worse than what is already possible when running untrusted Vim scripts.

Vim as shipped in Red Hat Enterprise Linux 8 is not affected by this flaw. The flaw is out of support scope for Red Hat Enterprise Linux 6 and 7.

Affected upstream versions: unspecified < 8.2.3564
Fixed upstream versions: 8.2.3564
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 777e7c21b7627be80961848ac560cb0a9978ff43
CVE-2021-3905: openvswitch: External triggered memory leak in Open vSwitch while processing fragmented packets
Component: openvswitch
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-09-29T00:00:00+00:00

A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.

Statement: Red Hat Enterprise Linux 7 provides the `openvswitch` package only through the unsupported Optional repository. Customers are advised to install Open vSwitch (OVS) from RHEL Fast Datapath instead.

Red Hat OpenStack Platform deployments are not affected because they use OVS/OVN directly from the Fast Datapath channel. Any updates will be distributed through that channel.

Affected upstream versions: Fixed in v2.17.0
Fixed upstream versions: v2.17.0
Upstream repository: https://github.com/openvswitch/ovs
Upstream fix commit: 803ed12e31b0377c37d7aa8c94b3b92f2081e349
CVE-2021-3917: coreos-installer: restrict access permissions on /boot/ignition{,/config.ign}
Component: coreos-installer
Severity: Moderate
CWE: CWE-276 (Incorrect Default Permissions)
CVSS v3: 5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
Public date: 2021-07-07T00:00:00+00:00

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.


Affected upstream versions: Fixed in coreos-installer 0.10.0
Fixed upstream versions: v0.10.0
Upstream repository: https://github.com/coreos/coreos-installer
Upstream fix commit: 2a36405339c87b16ed6c76e91ad5b76638fbdb0c
CVE-2021-3918: nodejs-json-schema: Prototype pollution vulnerability
Component: nodejs-json-schema
Severity: Important
CWE: CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes)
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-10-03T00:00:00+00:00

The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.

Statement: npm versions 8.0.0 and older provide a vulnerable version of the json-schema library. However, it is currently believed that in the context of npm, it is not possible to take advantage of the vulnerability.

Red Hat Enterprise Linux version 8 and Software Collections provide a vulnerable version of the json-schema library only as embedded in the npm package. As a result, the severity of the incident has been lowered for these 2 products.

Red Hat Quay includes json-schema as a development dependency of quay-registry-container. As a result, the impact rating has been lowered to Moderate.

In Red Hat OpenShift Container Platform (RHOCP), Red Hat Openshift Data Foundations (ODF), Red Hat distributed tracing, Migration Toolkit for Virtualization (MTV) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable json-schema library to authenticated users only, therefore the impact is reduced to Moderate.

In Red Hat Openshift Data Foundations (ODF) the odf4/mcg-core-rhel8 component has "Will not fix status", but starting from ODF 4.11 stream this component contains already patched version of the json-schema library. Earlier version of ODF are already under Maintenance Support phase, hence this vulnerability will not be fixed.

Affected upstream versions: unspecified <= 0.3.0
Fixed upstream versions: v0.4.0
Upstream repository: https://github.com/kriszyp/json-schema
Upstream fix commit: 22f146111f541d9737e832823699ad3528ca7741
CVE-2021-39191: mod_auth_openidc: open redirect due to target_link_uri parameter not validated
Component: mod_auth_openidc
Severity: Moderate
CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
CVSS v3: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2021-09-03T00:00:00+00:00

A open redirect flaw was found in mod_auth_openidc where it does not sanitize target_link_uri paramater properly. This issue could be used by a remote attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. As a result of this redirection victim users may give more credibility to the attacker controlled server because coming from a trusted application.


Affected upstream versions: <=2.4.9.3
Fixed upstream versions: v2.4.9.4
Upstream repository: https://github.com/zmartzone/mod_auth_openidc
Upstream fix commit: 03e6bfb446f4e3f27c003d30d6a433e5dd8e2b3d
CVE-2021-39226: grafana: Snapshot authentication bypass
Component: grafana
Severity: Important
CWE: CWE-639 (Authorization Bypass Through User-Controlled Key)
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2021-10-05T00:00:00+00:00

An authentication bypass was found in grafana. An attacker on the network is able to view and delete snapshots by accessing a literal path.

Statement: In OpenShift Container Platform (OCP), Red Hat Advanced Cluster Management for Kubernetes (RHACM), and OpenShift ServiceMesh (OSSM) the grafana components are protected by OpenShift OAuth that reduces the impact of this flaw to Moderate. Access to the grafana panel where snapshots can be created requires admin permissions. Additionally snapshots by default are not available to unauthenticated users and don't contain sensitive data.

Since snapshots by default are not available to unauthenticated users and don't contain sensitive data, impact has been lowered for Red Hat Gluster Storage 3.

Affected upstream versions: >= 8.0.0, < 8.1.6, < 7.5.11
Fixed upstream versions: v8.1.6
Upstream repository: https://github.com/grafana/grafana
Upstream fix commit: 2d456a6375855364d098ede379438bf7f0667269
CVE-2021-39240: haproxy: does not ensure that the scheme and path portions of a URI have the expected characters
Component: haproxy
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2021-08-17T00:00:00+00:00

A flaw was found in haproxy. An input validation flaw when processing HTTP/2 requests causes haproxy to not ensure that the scheme and path portions of a URI have the expected characters.  This may cause specially crafted input to bypass implemented security restrictions. The highest threat from this vulnerability is confidentiality.


Affected upstream versions: n/a
Fixed upstream versions: v2.5.0
Upstream repository: https://git.haproxy.org/haproxy.git
Upstream fix commit: a495e0d94876c9d39763db319f609351907a31e8
CVE-2021-39241: haproxy: an HTTP method name may contain a space followed by the name of a protected resource
Component: haproxy
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2021-08-17T00:00:00+00:00

haproxy has an input validation flaw that could allow a remote attacker to bypass implemented security restrictions.  An HTTP method name may contain a space followed by the name of a protected resource. Given this, It is possible that an server would interpret this as a request for that protected resource. The highest threat from this vulnerability is possible confidentiality concerns.


Affected upstream versions: n/a
Fixed upstream versions: v2.5.0
Upstream repository: https://git.haproxy.org/haproxy.git
Upstream fix commit: 89265224d314a056d77d974284802c1b8a0dc97f
CVE-2021-39242: haproxy: it can lead to a situation with an attacker-controlled HTTP Host header because a mismatch between Host and authority is mishandled
Component: haproxy
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2021-08-17T00:00:00+00:00

haproxy was found to be vulnerable to HTTP host header attack: This problem creates a scenario in which it's possible to drop the Host header and use the authority only after forwarding to a
second http2 layer,  possibly causing two differing values of Host at a different stage. The highest threat from this vulnerability is data integrity.


Affected upstream versions: n/a
Fixed upstream versions: v2.5.0
Upstream repository: https://git.haproxy.org/haproxy.git
Upstream fix commit: b5d2b9e154d78e4075db163826c5e0f6d31b2ab1
CVE-2021-3975: libvirt: segmentation fault during VM shutdown can lead to vdsm hang
Component: libvirt
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-11-17T00:00:00+00:00

A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.


Affected upstream versions: Fixed in libvirt v7.1.0
Fixed upstream versions: v7.1.0
Upstream repository: https://github.com/libvirt/libvirt
Upstream fix commit: 1ac703a7d0789e46833f4013a3876c2e3af18ec7
CVE-2021-3979: ceph: Ceph volume does not honour osd_dmcrypt_key_size
Component: ceph
Severity: Moderate
CWE: CWE-287 (Improper Authentication)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2022-01-11T00:00:00+00:00

A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks.

Statement: Red Hat OpenStack Platform deployments use the ceph package directly from the Ceph channel; the RHOSP package will not be updated at this time.

Affected upstream versions: Not-Known
Fixed upstream versions: v18.0.0
Upstream repository: https://github.com/ceph/ceph
Upstream fix commit: 47c33179f9a15ae95cc1579a421be89378602656
CVE-2021-3984: vim: illegal memory access in find_start_brace() in cindent.c when C-indenting
Component: vim
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H)
Public date: 2021-11-18T00:00:00+00:00

A flaw was found in vim. A possible heap-based buffer overflow allows an attacker to input a specially crafted file, leading to a crash or code execution. The highest threat from this vulnerability is confidentiality, integrity, and system availability.


Affected upstream versions: unspecified < 8.2.3625
Fixed upstream versions: 8.2.3625
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 2de9b7c7c8791da8853a9a7ca9c467867465b655
CVE-2021-3999: glibc: Off-by-one buffer overflow/underflow in getcwd()
Component: glibc
Severity: Moderate
CWE: CWE-193 (Off-by-one Error)
CVSS v3: 7.4 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-01-11T00:00:00+00:00

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

Statement: This issue was rated as having Moderate impact because of the prerequisites required for successful exploitation. To the best of our knowledge, there is no actual setuid exposure to the vulnerable getcwd() usage pattern.

Affected upstream versions: Fixed in glibc v2.31 and above.
Fixed upstream versions: glibc-2.35
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: 23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e