huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2019-19925: sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive
Component: sqlite
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-01-08T00:00:00+00:00

zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.

Statement: The zip extension was introduced in sqlite-3.22.0, therefore previous versions are not affected by this flaw.

Affected upstream versions: n/a
Fixed upstream versions: version-3.31.0
Upstream repository: https://github.com/sqlite/sqlite
Upstream fix commit: 54d501092d88c0cf89bec4279951f548fb0b8618
CVE-2019-19926: sqlite: error mishandling because of incomplete fix of CVE-2019-19880
Component: sqlite
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-12-20T00:00:00+00:00

multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.

Statement: This vulnerability exists because of an incomplete fix for CVE-2019-19880.  Currently Red Hat Products shipping sqlite have not fixed CVE-2019-19880 and therefore are not affected by this flaw.

Affected upstream versions: n/a
Fixed upstream versions: version-3.31.0
Upstream repository: https://github.com/sqlite/sqlite
Upstream fix commit: 8428b3b437569338a9d1e10c4cd8154acbe33089
CVE-2019-19956: libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c
Component: libxml2
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-01-08T00:00:00+00:00

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.10
Upstream repository: https://gitlab.gnome.org/GNOME/libxml2
Upstream fix commit: 5a02583c7e683896d84878bd90641d8d9b0d0549
CVE-2019-19959: sqlite: mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames
Component: sqlite
Severity: Moderate
CWE: CWE-626 (Null Byte Interaction Error (Poison Null Byte))
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2019-12-23T00:00:00+00:00

ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.

Statement: The zip extension was introduced in sqlite-3.22.0, therefore previous versions are not affected by this flaw.

Affected upstream versions: n/a
Fixed upstream versions: version-3.31.0
Upstream repository: https://github.com/sqlite/sqlite
Upstream fix commit: d8f2d46cbc9925e034a68aaaf60aad788d9373c1
CVE-2019-20054: kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c
Component: kernel
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-12-28T00:00:00+00:00

A flaw was found in the Linux kernel’s implementation of dropping sysctl entries. A local attacker who has access to load modules on the system can trigger a condition during module load failure and panic the system.


Affected upstream versions: n/a
Fixed upstream versions: v5.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 23da9588037ecdd4901db76a5b79a42b529c4ec3
CVE-2019-20095: kernel: memory leak in mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.2 (CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's mwifiex driver implementation when connecting to other WiFi devices in "Test Mode." A kernel memory leak can occur if an error condition is met during the parameter negotiation. This issue can lead to a denial of service if multiple error conditions meeting the repeated connection attempts are attempted.


Affected upstream versions: n/a
Fixed upstream versions: v5.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 003b686ace820ce2d635a83f10f2d7f9c147dabc
CVE-2019-20218: sqlite: selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error
Component: sqlite
Severity: Moderate
CWE: CWE-391 (Unchecked Error Condition)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-01-02T00:00:00+00:00

selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.


Affected upstream versions: n/a
Fixed upstream versions: version-3.31.0
Upstream repository: https://github.com/sqlite/sqlite
Upstream fix commit: a6c1a71cde082e09750465d5675699062922e387
CVE-2019-20372: nginx: HTTP request smuggling in configurations with URL redirect used as error_page
Component: nginx
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2020-01-09T00:00:00+00:00

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

Statement: Ansible Tower 3.5 and 3.6 are not vulnerable by default as are not using error_page variable in the nginx configuration. However, Ansible Tower 3.5 and 3.6 are distributing nginx 1.14 and 1.16 vulnerable versions as a dependency and configuration could be modified making it vulnerable.

Red Hat CloudForms Management Engine 5.9 and 5.10 are not vulnerable by default as are not using error_page variable in the nginx configuration. However, both mentioned builds ships vulnerable nginx versions 1.10 and 1.14 respectively. CloudForms 5.11 does not use nginx directly hence it is not vulnerable.

Red Hat Quay's configuration of nginx means it's not affected by this issue. It doesn't use error_page to do a 302 redirect. It's only use of error_page uses a named location ie:
error_page 404 /404.html;
   location = /40x.html {
 }
error_page 500 502 503 504 /50x.html;
    location = /50x.html {
}

Affected upstream versions: n/a
Fixed upstream versions: release-1.17.7
Upstream repository: https://github.com/nginx/nginx
Upstream fix commit: c1be55f97211d38b69ac0c2027e6812ab8b1b94e
CVE-2019-20382: QEMU: vnc: memory leakage upon disconnect
Component: QEMU
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.5 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2019-09-17T00:00:00+00:00

A memory leakage flaw was found in the way the VNC display driver of QEMU handled the connection disconnect when ZRLE and Tight encoding are enabled. Two VncState objects are created, and one allocates memory for the Zlib's data object. This allocated memory is not freed upon disconnection, resulting in a memory leak. An attacker able to connect to the VNC server could use this flaw to leak host memory,  leading to a potential denial of service.

Statement: This flaw did not affect the versions of `qemu-kvm` as shipped with Red Hat Enterprise Linux 6 as they did not include the vulnerable code.

Affected upstream versions: n/a
Fixed upstream versions: v4.2.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 6bf21f3d83e95bcc4ba35a7a07cc6655e8b010b0
CVE-2019-20386: systemd: memory leak in button_open() in login/logind-button.c when udev events are received
Component: systemd
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 2.4 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2020-01-22T00:00:00+00:00

A memory leak was discovered in the systemd-login when a power-switch event is received. A physical attacker may trigger one of these events and leak bytes due to a missing free.

Statement: The version of systemd delivered in OpenShift Container Platform 4.1 and included in CoreOS images has been superseded by the version delivered in Red Hat Enterprise Linux 8. CoreOS updates for systemd in will be consumed from Red Hat Enterprise Linux 8 channels.

Affected upstream versions: n/a
Fixed upstream versions: v243
Upstream repository: https://github.com/systemd/systemd
Upstream fix commit: b2774a3ae692113e1f47a336a6c09bac9cfb49ad
CVE-2019-20387: libsolv: out-of-bounds read in repodata_schema2id in repodata.c
Component: libsolv
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-01-21T00:00:00+00:00

An out-of-bounds read was discovered in Libsolv when the last schema has a length that is less than the length of the input schema. A remote attacker may abuse this flaw to crash an application that uses Libsolv.


Affected upstream versions: n/a
Fixed upstream versions: 0.7.6
Upstream repository: https://github.com/openSUSE/libsolv
Upstream fix commit: fdb9c9c03508990e4583046b590c30d958f272da
CVE-2019-20391: libyang: invalid memory access in resolve_feature_value() when a if-feature is used inside a bit
Component: libyang
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-04-26T00:00:00+00:00

An invalid memory access flaw occurs in libyang in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to process untrusted input YANG files may crash.


Affected upstream versions: n/a
Fixed upstream versions: v1.0-r3
Upstream repository: https://github.com/CESNET/libyang
Upstream fix commit: bdb596ddc07596fa212f231135b87d0b9178f6f8
CVE-2019-20392: libyang: invalid memory access when if-feature statement is used inside a list key node
Component: libyang
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-03-07T00:00:00+00:00

An invalid memory access flaw was discovered in libyang in the function resolve_feature_value() when an if-feature statement is used inside a list key node and the feature used is not defined. Applications that use libyang to process untrusted input YANG files may crash.


Affected upstream versions: n/a
Fixed upstream versions: v1.0-r1
Upstream repository: https://github.com/CESNET/libyang
Upstream fix commit: 32fb4993bc8bb49e93e84016af3c10ea53964be5
CVE-2019-20393: libyang: double-free in function yyparse() when empty description is used
Component: libyang
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-03-29T00:00:00+00:00

A double-free flaw occurs in libyang in function yyparse() when an empty description is used. Applications that use libyang to process untrusted input YANG files may be vulnerable to this flaw, possibly causing a crash or potential code execution.


Affected upstream versions: n/a
Fixed upstream versions: v1.0-r1
Upstream repository: https://github.com/CESNET/libyang
Upstream fix commit: d9feacc4a590d35dbc1af21caf9080008b4450ed
CVE-2019-20394: libyang: double-free in yyparse() when a type statement is used in a notification statement
Component: libyang
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-04-26T00:00:00+00:00

A double-free flaw occurs in libyang in function yyparse() when a type statement is used in a notification statement. Applications that use libyang to process untrusted input YANG files may be vulnerable to this flaw, possibly causing a crash or potential code execution.


Affected upstream versions: n/a
Fixed upstream versions: v1.0-r3
Upstream repository: https://github.com/CESNET/libyang
Upstream fix commit: 6cc51b1757dfbb7cff92de074ada65e8523289a6
CVE-2019-20395: libyang: stack-overflow when parsing yang files with self-referential union types
Component: libyang
Severity: Low
CWE: CWE-674 (Uncontrolled Recursion)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-03-08T00:00:00+00:00

A stack-overflow flaw was found in libyang due to a self-referential union type containing leafrefs. Applications that use libyang to process untrusted input YANG files may crash while processing malformed files.


Affected upstream versions: n/a
Fixed upstream versions: v1.0-r1
Upstream repository: https://github.com/CESNET/libyang
Upstream fix commit: 4e610ccd87a2ba9413819777d508f71163fcc237
CVE-2019-20396: libyang: heap-based buffer over-read in function lys_type_free() due to malformed pattern
Component: libyang
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Public date: 2019-03-29T00:00:00+00:00

A heap-based buffer over-read flaw occurs in libyang in function lys_type_free() due to a malformed pattern statement value. Applications that use libyang to process untrusted input yang files may be vulnerable to this flaw, possibly causing a crash or information leaks.


Affected upstream versions: n/a
Fixed upstream versions: v1.0-r1
Upstream repository: https://github.com/CESNET/libyang
Upstream fix commit: a1f17693904ed6fecc8902c747fc50a8f20e6af8
CVE-2019-20397: libyang: double-free in yyparse() when organization field is not terminated
Component: libyang
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-03-28T00:00:00+00:00

A double-free flaw occurs in libyang in function yparse() when an organization field is not terminated. Applications that use libyang to process untrusted input YANG files may be vulnerable to this flaw, possibly causing a crash or potential code execution.


Affected upstream versions: n/a
Fixed upstream versions: v1.0-r1
Upstream repository: https://github.com/CESNET/libyang
Upstream fix commit: 88bd6c548ba79bce176cd875e9b56e7e0ef4d8d4
CVE-2019-20398: libyang: NULL pointer dereference in function lys_extension_instances_free()
Component: libyang
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-04-29T00:00:00+00:00

A NULL pointer dereference flaw occurs in libyang in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang to process untrusted input YANG files may crash.


Affected upstream versions: n/a
Fixed upstream versions: v1.0-r3
Upstream repository: https://github.com/CESNET/libyang
Upstream fix commit: 7852b272ef77f8098c35deea6c6f09cb78176f08
CVE-2019-20421: exiv2: infinite loop and hang in Jp2Image::readMetadata() in jp2image.cpp could lead to DoS
Component: exiv2
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-09-30T00:00:00+00:00

A denial of service vulnerability was found in exiv2 in the way JPEG 2000 (JP2) metadata was read when processing an image file. A remote attacker could abuse this flaw to create a specially crafted image, causing exiv2 to enter into an infinite loop when processing an incoming malicious image.

Statement: This flaw did not affect the versions of exiv2 as shipped with Red Hat Enterprise Linux 6, 7, and 8 as they did not include the vulnerable code, which was introduced in a later version of the library.

Affected upstream versions: n/a
Fixed upstream versions: v0.27.3
Upstream repository: https://github.com/Exiv2/exiv2
Upstream fix commit: a82098f4f90cd86297131b5663c3dec6a34470e8
CVE-2019-20479: mod_auth_openidc: Open redirect issue exists in URLs with slash and backslash
Component: mod_auth_openidc
Severity: Moderate
CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
CVSS v3: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2019-11-12T00:00:00+00:00

An open redirect flaw was discovered in mod_auth_openidc where it handles logout redirection. The module does not correctly validate the URL, allowing a URL with slash and backslash at the beginning to bypass the protection checks. A victim user may be tricked into visiting a trusted vulnerable web site, which would redirect him to another, possibly malicious, URL.

Statement: It is not possible to reproduce the open redirect vulnerability in the versions of mod_auth_openidc as shipped in Red Hat Enterprise Linux 7, as a missing check makes the process crash, due to a NULL pointer dereference, instead of letting it continue with an invalid URL.

Affected upstream versions: n/a
Fixed upstream versions: v2.4.1
Upstream repository: https://github.com/zmartzone/mod_auth_openidc
Upstream fix commit: 02431c0adfa30f478cf2eb20ed6ea51fdf446be7
CVE-2019-20485: libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent
Component: libvirt
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.8 (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H)
Public date: 2019-12-05T00:00:00+00:00

A flaw was found in the way the libvirtd daemon issued the 'suspend' command to a QEMU guest-agent running inside a guest, where it holds a monitor job while issuing the 'suspend' command to a guest-agent. A malicious guest-agent may use this flaw to block the libvirt daemon indefinitely, resulting in a denial of service.

Statement: This issue affects the version of the libvirt package as shipped with Red Hat Enterprise Linux 7, 8 and Red Hat Enterprise Linux Advanced Virtualization 8. Future libvirt updates for Red Hat Enterprise Linux 7, 8 and Red Hat Enterprise Linux Advanced Virtualization 8 may address this issue.

Red Hat Enterprise Linux version 5 and 6 are in Maintenance Support 2 Phase of the life cycle. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates of the Red Hat Enterprise Linux version 5 and 6. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v6.0.0
Upstream repository: https://libvirt.org/git/libvirt.git
Upstream fix commit: a663a860819287e041c3de672aad1d8543098ecc
CVE-2019-20503: usrsctp: Out of bounds reads in sctp_load_addresses_from_init()
Component: usrsctp
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2020-03-10T00:00:00+00:00

The Mozilla Foundation Security Advisory describes this flaw as:

The inputs to `sctp_load_addresses_from_init` are verified by `sctp_arethere_unrecognized_parameters`; however, the two functions handled parameter bounds differently, resulting in out of bounds reads when parameters are partially outside a chunk.


Affected upstream versions: n/a
Fixed upstream versions: 0.9.4.0
Upstream repository: https://github.com/sctplab/usrsctp
Upstream fix commit: 790a7a2555aefb392a5a69923f1e9d17b4968467
CVE-2019-20636: kernel: out-of-bounds write via crafted keycode table
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-04-04T00:00:00+00:00

An out-of-bounds write flaw was found in the Linux kernel. A crafted keycode table could be used by drivers/input/input.c to perform the out-of-bounds write. A local user with root access can insert garbage to this keycode table that can lead to out-of-bounds memory access. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: This issue was rated as having Moderate impact because of the need of physical access or administrator privileges to trigger it.

Affected upstream versions: n/a
Fixed upstream versions: v5.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: cb222aed03d798fc074be55e59d9a112338ee784
CVE-2019-20788: libvncserver: integer overflow and heap-based buffer overflow in libvncclient/cursor.c in HandleCursorShape function
Component: libvncserver
Severity: None
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N)
Public date: 2019-11-17T00:00:00+00:00

A flaw was found in libvncserver in versions through 0.9.12. A large height or width value may cause an integer overflow or a heap-based buffer overflow. The highest threat from this vulnerability is to system availability.

Statement: This flaw was found to be a duplicate of CVE-2019-15690. Please see https://access.redhat.com/security/cve/CVE-2019-15690 for information about affected products and security errata.

Affected upstream versions: n/a
Fixed upstream versions: LibVNCServer-0.9.13
Upstream repository: https://github.com/LibVNC/libvncserver
Upstream fix commit: 54220248886b5001fbbb9fa73c4e1a2cb9413fed
CVE-2019-20792: opensc: Double free in coolkey_free_private_data in libopensc/card-coolkey.c
Component: opensc
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.4 (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-01-04T00:00:00+00:00

A use-after-free vulnerability was discovered in OpenSC while disconnecting a smart card. This flaw allows a physical attacker to exploit this vulnerability by inserting and removing a malicious smart card, handled by the coolkey driver, that could potentially execute code on the target system, with privileges that depend on the particular configuration and system that makes use of the OpenSC library.


Affected upstream versions: n/a
Fixed upstream versions: 0.20.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: c246f6f69a749d4f68626b40795a4f69168008f4
CVE-2019-20807: vim: users can execute arbitrary OS commands via scripting interfaces in the rvim restricted mode
Component: vim
Severity: Moderate
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2020-02-08T00:00:00+00:00

A flaw was found in vim in the restricted mode, where all commands that make use of external shells are disabled. However, it was found that users could still execute some arbitrary OS commands in the restricted mode. This flaw was fixed by filtering the functions that can call OS commands. Interfaces such as Python, Ruby, and Lua, are also disabled, as they can be used to execute shell commands. Perl uses the Safe module.

Statement: Upstream suggests that users may still find loopholes to execute a shell commands, it has only been made difficult. So administrators should not assume that vim restricted mode will completely disable execution of OS commands.

Affected upstream versions: n/a
Fixed upstream versions: v8.1.0881
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 8c62a08faf89663e5633dc5036cd8695c80f1075