huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-21654: envoy: Incorrect configuration handling allows mTLS session re-use without re-validation
Component: envoy
Severity: Important
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L)
Public date: 2022-02-22T07:00:00+00:00

A flaw was found in envoy. When certificate validation settings are changed, incorrect configuration handling allows TLS session reuse without revalidation.


Affected upstream versions: >= 1.7.0, < 1.18.6, >= 1.19.0, < 1.19.3, >= 1.20.0, < 1.20.2, >= 1.21.0, < 1.21.1
Fixed upstream versions: v1.22.0
Upstream repository: https://github.com/envoyproxy/envoy
Upstream fix commit: e9f936d85dc1edc34fabd0a1725ec180f2316353
CVE-2022-21655: envoy: Incorrect handling of internal redirects to routes with a direct response entry
Component: envoy
Severity: Important
CWE: CWE-670 (Always-Incorrect Control Flow Implementation)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-02-22T07:00:00+00:00

A flaw was found in envoy. Due to incorrect handling of the common router, a segfault is possible when internal redirects are routes with a direct response entry.


Affected upstream versions: < 1.18.6, >= 1.19.0, < 1.19.3, >= 1.20.0, < 1.20.2, >= 1.21.0, < 1.21.1
Fixed upstream versions: v1.22.0
Upstream repository: https://github.com/envoyproxy/envoy
Upstream fix commit: 177d608155ba8b11598b9bbf8240e90d8c350682
CVE-2022-21658: rust: Race condition in remove_dir_all leading to removal of files outside of the directory being removed
Component: rust
Severity: Moderate
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N)
Public date: 2022-01-20T11:00:00+00:00

A race condition flaw was found in Rust's std::fs::remove_dir_all function. Rust applications that use this function may be vulnerable to a race condition where an unprivileged attacker can trick the application into deleting files and directories, causing an impact on system data integrity. If the application is privileged, an attacker can possibly delete files they would not usually have access to.

Statement: This flaw has been given a Severity of Moderate because it is not exploitable at will on every Rust program as it requires a specific scenario where a privileged program uses a specific Rust stdlib function, the attacker has some knowledge of the program's file operations,  and has the normal limitations and challenges of a 
Time-of-check to time-of-use (TOCTOU). It must also be carried out by an unprivileged attacker.

Affected upstream versions: < 1.58.1
Fixed upstream versions: 1.58.1
Upstream repository: https://github.com/rust-lang/rust
Upstream fix commit: 32ed6e599bb4722efefd78bbc9cd7ec4613cb946
CVE-2022-21680: marked: regular expression block.def may lead Denial of Service
Component: marked
Severity: Moderate
CWE: CWE-186 (Overly Restrictive Regular Expression)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-01-14T00:00:00+00:00

A vulnerability was found in the markedjs package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.


Affected upstream versions: < 4.0.10
Fixed upstream versions: v4.0.10
Upstream repository: https://github.com/markedjs/marked
Upstream fix commit: c4a3ccd344b6929afa8a1d50ac54a721e57012c0
CVE-2022-21681: marked: regular expression inline.reflinkSearch may lead Denial of Service
Component: marked
Severity: Moderate
CWE: CWE-186 (Overly Restrictive Regular Expression)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-01-14T00:00:00+00:00

A vulnerability was found in the markedjs package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.


Affected upstream versions: < 4.0.10
Fixed upstream versions: v4.0.10
Upstream repository: https://github.com/markedjs/marked
Upstream fix commit: 8f806573a3f6c6b7a39b8cdb66ab5ebb8d55a5f5
CVE-2022-21682: flatpak: flatpak-builder --mirror-screenshots-url can access files outside the build directory
Component: flatpak
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N)
Public date: 2022-01-12T00:00:00+00:00

A path traversal vulnerability was found in Flatpak. This happens when flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions.


Affected upstream versions: >= 1.11.0, < 1.12.3, < 1.10.6
Fixed upstream versions: 1.13.1
Upstream repository: https://github.com/flatpak/flatpak
Upstream fix commit: 445bddeee657fdc8d2a0a1f0de12975400d4fc1a
CVE-2022-21702: grafana: XSS vulnerability in data source handling
Component: grafana
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N)
Public date: 2022-02-08T00:00:00+00:00

A Cross-site scripting (XSS) vulnerability was found in the way Grafana handles data sources. This flaw allows an attacker to serve HTML content through the Grafana data source or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site scripting (XSS) attack. Should an existing data source connected to Grafana be compromised, it could be used to inappropriately gain access to other data sources connected to the same Grafana org.


Affected upstream versions: >= 2.0.0-beta1, < 7.5.15, >= 8.0.0, < 8.3.5
Fixed upstream versions: v7.5.15
Upstream repository: https://github.com/grafana/grafana
Upstream fix commit: 27726868b3d7c613844b55cd209ca93645c99b85
CVE-2022-21708: graphql-go: Denial of service via stack overflow panics
Component: graphql-go
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-01-22T00:00:00+00:00

graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. The issue has been patched in version `v1.3.0`. The only known workaround for this issue is to disable the `graphql.MaxDepth` option from your schema which is not recommended.


Affected upstream versions: < 1.3.0
Fixed upstream versions: v1.3.0
Upstream repository: https://github.com/graph-gophers/graphql-go
Upstream fix commit: eae31ca73eb3473c544710955d1dbebc22605bfe
CVE-2022-21712: dev-python/twisted: secret exposure in cross-origin redirects
Component: dev-python/twisted
Severity: Moderate
CWE: CWE-346 (Origin Validation Error)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-02-08T00:00:00+00:00

A flaw was found in the twisted Python library when WebClient redirects via the RedirectAgent and BrowserLikeRedirectAgent methods. This flaw allows an attacker to take advantage of these cross-origin redirects and leak the cookie and authorization headers.


Affected upstream versions: >= 11.1.0, < 22.1.0
Fixed upstream versions: twisted-22.1.0
Upstream repository: https://github.com/twisted/twisted
Upstream fix commit: af8fe78542a6f2bf2235ccee8158d9c88d31e8e2
CVE-2022-21716: python-twisted: SSH client and server denial of service during SSH handshake
Component: python-twisted
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-03-03T00:00:00+00:00

An uncontrolled resource consumption flaw was found in python-twisted in the dataReceived() function. This flaw allows an unauthenticated, remote attacker to send a simple command to use all available memory and crash the server.


Affected upstream versions: < 22.2.0
Fixed upstream versions: twisted-22.2.0
Upstream repository: https://github.com/twisted/twisted
Upstream fix commit: 89c395ee794e85a9657b112c4351417850330ef9
CVE-2022-21724: jdbc-postgresql: Unchecked Class Instantiation when providing Plugin Classes
Component: jdbc-postgresql
Severity: Moderate
CWE: CWE-665 (Improper Initialization)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-02-01T00:00:00+00:00

pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue.

Statement: According to the patch upstream the scoring of this issue has been severely reduced and is no longer considered an RCE. Therefore, the flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 6, 7 and 8.

Affected upstream versions: n/a
Fixed upstream versions: REL42.3.2
Upstream repository: https://github.com/pgjdbc/pgjdbc
Upstream fix commit: f4d0ed69c0b3aae8531d83d6af4c57f22312c813
CVE-2022-2196: kernel: KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks
Component: kernel
Severity: Moderate
CWE: CWE-1188 (Initialization of a Resource with an Insecure Default)
CVSS v3: 5.6 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)
Public date: 2022-09-28T00:00:00+00:00

A flaw was found in the KVM's Intel nested virtualization feature (nVMX). Since L1 and L2 shared branch prediction modes (guest-user and guest-kernel), KVM did not protect indirect branches in L1 from steering by a malicious agent in L2. This could allow a malicious nested guest to carry out Spectre v2 attacks against L1 due to a missing IBPB at VM-exit time.

Statement: Red Hat currently provides the nested virtualization feature as a Technology Preview. Nested virtualization is therefore unsupported for production use. For more information please refer to https://access.redhat.com/solutions/21101 and https://access.redhat.com/support/offerings/techpreview.

Affected upstream versions: <= v6.0
Fixed upstream versions: 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5
CVE-2022-2309: lxml: NULL Pointer Dereference in lxml
Component: lxml
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-07-05T00:00:00+00:00

A NULL Pointer dereference vulnerability found in lxml, caused by the iterwalk function (also used by the canonicalize function). This flaw can lead to a crash when the incorrect parser input occurs together with usages.


Affected upstream versions: unspecified < 4.9.1
Fixed upstream versions: 4.9.1
Upstream repository: https://github.com/lxml/lxml
Upstream fix commit: 86368e9cf70a0ad23cccd5ee32de847149af0c6f
CVE-2022-2320: xorg-x11-server: out-of-bounds access in ProcXkbSetDeviceInfo request handler of the Xkb extension
Component: xorg-x11-server
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-07-12T00:00:00+00:00

A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of ProcXkbSetDeviceInfo requests. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. This flaw allows an attacker to escalate privileges and execute arbitrary code in the context of root.

Statement: Xorg server does not run with root privileges in Red Hat Enterprise Linux 8, therefore this flaw has been rated as having Moderate impact.

Affected upstream versions: xorg-x11-server 21.1
Upstream repository: https://github.com/freedesktop/xorg-xserver
Upstream fix commit: dd8caf39e9e15d8f302e54045dd08d8ebf1025dc
CVE-2022-23222: kernel: local privileges escalation in kernel/bpf/verifier.c
Component: kernel
Severity: Moderate
CWE: CWE-763 (Release of Invalid Pointer or Reference)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-01-14T00:00:00+00:00

A flaw was found in the Linux kernel's adjust_ptr_min_max_vals in the kernel/bpf/verifier.c function. In this flaw, a missing sanity check for *_OR_NULL pointer types that perform pointer arithmetic may cause a kernel information leak issue.

Statement: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl.   

This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.

For the Red Hat Enterprise Linux 7 the eBPF for unprivileged users is always disabled.
For the Red Hat Enterprise Linux 8 to confirm the current state, inspect the sysctl with the command:
~~~
# cat /proc/sys/kernel/unprivileged_bpf_disabled
~~~
The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.

A kernel update will be required to mitigate the flaw for the root or users with CAP_SYS_ADMIN capabilities.

Affected upstream versions: n/a
Fixed upstream versions: v5.17
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 64620e0a1e712a778095bd35cbb277dc2259281f
CVE-2022-23308: libxml2: Use-after-free of ID and IDREF attributes
Component: libxml2
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-02-20T00:00:00+00:00

A flaw was found in libxml2. A call to the xmlGetID function can return a pointer already freed when parsing an XML document with the XML_PARSE_DTDVALID option and without the XML_PARSE_NOENT option, resulting in a use-after-free issue.

Statement: The security impact of xmlGetID() returning a pointer to freed memory depends on the application and will mostly result in a denial of service (DoS). The typical use case of calling xmlGetID() on an unmodified document is not affected, therefore this issue was rated with a moderate severity.

Affected upstream versions: n/a
Fixed upstream versions: v2.9.13
Upstream repository: https://github.com/GNOME/libxml2
Upstream fix commit: 652dd12a858989b14eed4e84e453059cd3ba340e
CVE-2022-23517: rubygem-rails-html-sanitizer: Inefficient Regular Expression leading to denial of service
Component: rubygem-rails-html-sanitizer
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-12-13T00:00:00+00:00

An inefficient Regular Expression vulnerability was found in rubygem rails-html-sanitizer. Certain configurations are susceptible to excessive backtracking, leading to a denial of service through CPU resource consumption.


Affected upstream versions: < 1.4.4
Fixed upstream versions: v1.5.0
Upstream repository: https://github.com/rails/rails-html-sanitizer
Upstream fix commit: 56c61c0cebd1e493e8ad7bca2a0191609a4a6979
CVE-2022-23521: git: gitattributes parsing integer overflow
Component: git
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-01-17T00:00:00+00:00

A flaw was found in Git, a distributed revision control system. When parsing gitattributes, a mechanism to allow defining attributes for paths, multiple integer overflows can occur when there is a huge number of path patterns, attributes for a single pattern, or declared attribute names. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index, or both. This integer overflow can result in arbitrary heap reads and writes, which may allow remote code execution.


Affected upstream versions: < 2.30.7, >= 2.31.0, < 2.31.6, >= 2.32.0, < 2.32.5, >= 2.33.0, < 2.33.6, >= 2.34.0, < 2.34.6, >= 2.35.0, < 2.35.6, >= 2.36.0, < 2.36.4, >= 2.37.0, < 2.37.5, >= 2.38.0, < 2.38.3, = 2.39.0
Fixed upstream versions: v2.40.0
Upstream repository: https://github.com/git/git
Upstream fix commit: 508386c6c5857b4faa2c3e491f422c98cc69ae76
CVE-2022-23525: helm: Denial of service through through repository index file
Component: helm
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-12-15T00:00:00+00:00

A flaw was found in Helm. Applications that use the _repo_ package in Helm SDK to parse an index file may suffer a denial of service when that input causes a panic that cannot be recovered from. The Helm Client will panic with an index file that causes a memory violation panic.

Statement: Red Hat has rated this a Moderate impact as Helm is a user utility, which when ran locally, interacts with the kubernetes API. As such, a panic in the Helm client does not constitute an availability impact to the rest of the system(s).

Affected upstream versions: < v3.10.3
Fixed upstream versions: v3.11.0
Upstream repository: https://github.com/helm/helm
Upstream fix commit: 638ebffbc2e445156f3978f02fd83d9af1e56f5b
CVE-2022-23526: helm: Denial of service through schema file
Component: helm
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-12-15T00:00:00+00:00

A flaw was found in Helm, a tool for managing Charts, a pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the_chartutil_ package that could cause a segmentation violation. The _chartutil_ package contains a parser that loads a JSON Schema validation files into structures Go can work with. Some schema files can cause array data structures to be created, causing a memory violation. Applications that use the _chartutil_ package in the Helm SDK to parse a schema files may result in a denial of service.

Statement: This moderate severity flaw was found in the Helm SDK’s chartutil package, which occurs when parsing a specially crafted JSON Schema file, the parser can mishandle the input, triggering a segmentation violation (NULL Pointer Dereference) that causes the Helm client to panic. This results in a denial of service (DoS) for any application or process using the affected functions.

Affected upstream versions: < v3.10.3
Fixed upstream versions: v3.11.0
Upstream repository: https://github.com/helm/helm
Upstream fix commit: bafafa8bb1b571b61d7a9528da8d40c307dade3d
CVE-2022-23539: jsonwebtoken: Unrestricted key type could lead to legacy keys usagen
Component: jsonwebtoken
Severity: Moderate
CWE: CWE-327 (Use of a Broken or Risky Cryptographic Algorithm)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2022-12-23T00:00:00+00:00

A flaw was found in the jsonwebtoken package. The affected versions of the `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm.

Statement: The jsonwebtoken package is a transitive dependency and is not used directly in any of the Red Hat products. Hence, the impact is set to Moderate.

Affected upstream versions: <= 8.5.1
Fixed upstream versions: v9.0.0
Upstream repository: https://github.com/auth0/node-jsonwebtoken
Upstream fix commit: e1fa9dcc12054a8681db4e6373da1b30cf7016e3
CVE-2022-23540: jsonwebtoken: Insecure default algorithm in jwt.verify() could lead to signature validation bypass
Component: jsonwebtoken
Severity: Moderate
CWE: CWE-327 (Use of a Broken or Risky Cryptographic Algorithm)
CVSS v3: 6.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L)
Public date: 2022-12-22T00:00:00+00:00

A flaw was found in the jsonwebtoken library. In affected versions of the jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the jwt.verify() function may lead to signature validation bypass due to defaulting to the none algorithm for signature verification.


Affected upstream versions: <= 8.5.1
Fixed upstream versions: v9.0.0
Upstream repository: https://github.com/auth0/node-jsonwebtoken
Upstream fix commit: e1fa9dcc12054a8681db4e6373da1b30cf7016e3
CVE-2022-23541: jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
Component: jsonwebtoken
Severity: Moderate
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2022-12-22T00:00:00+00:00

A flaw was found in the jsonwebtoken library. Affected versions of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function will result in incorrect verification of tokens. Using a different algorithm and key combination in verification than what was used to sign the tokens, specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to the successful validation of forged tokens.


Affected upstream versions: <= 8.5.1
Fixed upstream versions: v9.0.0
Upstream repository: https://github.com/auth0/node-jsonwebtoken
Upstream fix commit: e1fa9dcc12054a8681db4e6373da1b30cf7016e3
CVE-2022-23552: grafana: persistent xss in grafana core plugins
Component: grafana
Severity: Important
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2023-01-27T00:00:00+00:00

A flaw was found in The GeoMap and Canvas plugins of Grafana. The GeoMap and Canvas plugins are core plugins in Grafana, which means that all Grafana instances have GeoMap and Canvas installed. These two plugins are vulnerable to Cross-site scripting, where an attacker with an Editor role can add an SVG file containing malicious JavaScript code. The Javascript is executed when a user with an admin role later edits the GeoMap/Canvas panel.


Affected upstream versions: >= 9.0, < 9.2.10, >= 9.3, < 9.3.4, >= 8.1, < 8.5.16
Fixed upstream versions: v9.3.6
Upstream repository: https://github.com/grafana/grafana
Upstream fix commit: 1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0
CVE-2022-23596: junrar: A carefully crafted RAR archive can trigger an infinite loop while extracting
Component: junrar
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-01-27T00:00:00+00:00

Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.


Affected upstream versions: n/a
Fixed upstream versions: v7.4.1
Upstream repository: https://github.com/junrar/junrar
Upstream fix commit: 7b16b3d90b91445fd6af0adfed22c07413d4fab7