huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2021-22543: kernel: Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks
Component: kernel
Severity: Important
CWE: CWE-863 (Incorrect Authorization)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-05-18T00:00:00+00:00

A flaw was found in the Linux kernel’s KVM implementation, where improper handing of the VM_IO|VM_PFNMAP VMAs in KVM bypasses RO checks and leads to pages being freed while still accessible by the VMM and guest. This flaw allows users who can start and control a VM to read/write random pages of memory, resulting in local privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.

Statement: Both Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 8 leverage udev to set the proper permissions (ugo=rw) of the `/dev/kvm` device, making it accessible to all users. It is worth noting that while the KVM rule is part of the main udev package in Red Hat Enterprise Linux 8, the same rule is shipped with the `qemu-kvm` package in Red Hat Enterprise Linux 7.  In other words, Red Hat Enterprise Linux 7 does not expose `/dev/kvm` to unprivileged users by default, as long as the `qemu-kvm` package is not installed.

Affected upstream versions: <= v5.12
Fixed upstream versions: v5.13
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: f8be156be163a052a067306417cd0ff679068c97
CVE-2021-22555: kernel: out-of-bounds write in xt_compat_target_from_user() in net/netfilter/x_tables.c
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-07-07T00:00:00+00:00

A flaw was discovered in processing setsockopt IPT_SO_SET_REPLACE (or IP6T_SO_SET_REPLACE) for 32 bit processes on 64 bit systems. This flaw will allow local user to gain privileges or cause a DoS through user name space. This action is usually restricted to root-privileged users but can also be leveraged if the kernel is compiled with CONFIG_USER_NS and CONFIG_NET_NS and the user is granted elevated privileges.

Statement: In Red Hat Enterprise Linux 7, only privileged users can trigger this bug. In Red Hat Enterprise Linux 8 a regular user can trigger it, however the result is corruption of 4 bytes of memory.

Affected upstream versions: 2.6.19-rc1 < unspecified
Fixed upstream versions: unspecified
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c
Upstream fix commit: b29c457a6511435960115c0f548c4360d5f4801d
CVE-2021-22569: protobuf-java: potential DoS in the parsing procedure for binary data
Component: protobuf-java
Severity: Moderate
CWE: CWE-696 (Incorrect Behavior Order)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2022-01-06T00:00:00+00:00

A flaw was found in protobuf-java. Google Protocol Buffer (protobuf-java) allows the interleaving of com.google.protobuf.UnknownFieldSet fields. By persuading a victim to open specially-crafted content, a remote attacker could cause a timeout in the ProtobufFuzzer function, resulting in a denial of service.


Affected upstream versions: unspecified < 3.16.1, unspecified < 3.18.2, unspecified < 3.19.2, unspecified < 3.18.2, unspecified < 3.19.2, unspecified < 3.19.2
Fixed upstream versions: 3.16.1, 3.18.2, 3.19.2
Upstream repository: https://github.com/protocolbuffers/protobuf
Upstream fix commit: b3093dce58bc9d3042f085666d83c8ef1f51fe7b
CVE-2021-22898: curl: TELNET stack contents disclosure
Component: curl
Severity: Low
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 3.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)
Public date: 2021-05-26T00:00:00+00:00

A flaw was found in the way curl handled telnet protocol option for sending environment variables, which could lead to sending of uninitialized data from a stack-based buffer to the server. This issue leads to potentially revealing sensitive internal information to the server using a clear-text network protocol.


Affected upstream versions: 7.7 through 7.76.1
Fixed upstream versions: curl-7_77_0
Upstream repository: https://github.com/curl/curl
Upstream fix commit: 39ce47f219b09c380b81f89fe54ac586c8db6bde
CVE-2021-22901: curl: Use-after-free in TLS session handling when using OpenSSL TLS backend
Component: curl
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-05-26T00:00:00+00:00

A use-after-free flaw was found in the way curl handled TLS session data. The curl versions using the OpenSSL library as their TLS backend could use freed memory after TLS session renegotiation was performed by the OpenSSL library. A malicious TLS server could use this flaw to crash or, possibly, execute arbitrary code with the privileges of a client application using the curl library.


Affected upstream versions: 7.75.0 through 7.76.1
Fixed upstream versions: curl-7_77_0
Upstream repository: https://github.com/curl/curl
Upstream fix commit: 7f4a9a9b2a49547eae24d2e19bc5c346e9026479
CVE-2021-23133: kernel: Race condition in sctp_destroy_sock list_del
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-04-18T09:00:00+00:00

A use-after-free flaw was found in the Linux kernel's SCTP socket functionality that triggers a race condition. This flaw allows a local user to escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: This issue is rated as having a Moderate impact because of the privileges required for running the known reproducer. The required privileges are CAP_BPF and CAP_NET_ADMIN capabilities that are disabled by default in Red Hat Enterprise Linux 7. For Red Hat Enterprise Linux 8, the SCTP protocol itself is disabled by default and cannot be used by a user without enablement by an administrator.

Affected upstream versions: unspecified < 5.12-rc8
Fixed upstream versions: 5.12-rc8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: b166a20b07382b8bc1dcee2a448715c9c2c81b5b
CVE-2021-23177: libarchive: extracting a symlink with ACLs modifies ACLs of target
Component: libarchive
Severity: Moderate
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L)
Public date: 2021-08-21T00:00:00+00:00

An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges.


Affected upstream versions: Fixed in libarchive 3.5.2
Fixed upstream versions: v3.5.2
Upstream repository: https://github.com/libarchive/libarchive
Upstream fix commit: fba4f123cc456d2b2538f811bb831483bf336bad
CVE-2021-23214: postgresql: server processes unencrypted bytes from man-in-the-middle
Component: postgresql
Severity: Moderate
CWE: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-11-11T00:00:00+00:00

It was found that a PostgreSQL server could accept plain text data during the establishment of an SSL connection. When a user is requesting a certificate based authentication, an active Person in the Middle could use this flaw in order to inject arbitrary SQL commands.

Statement: In Red Hat Virtualization the manager appliance uses a vulnerable version of postgresql. Once a fix has been shipped for RHEL 8 the appliance can consume the fix via a regular yum update.

Affected upstream versions: Affects v9.6 to v14
Fixed upstream versions: REL_15_0
Upstream repository: https://git.postgresql.org/gitweb/postgresql.git
Upstream fix commit: 28e24125541545483093819efae9bca603441951
CVE-2021-23222: postgresql: libpq processes unencrypted bytes from man-in-the-middle
Component: postgresql
Severity: Low
CWE: CWE-522 (Insufficiently Protected Credentials)
CVSS v3: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2021-11-11T00:00:00+00:00

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

Statement: In Red Hat Virtualization the manager appliance uses a vulnerable version of postgresql. Once a fix has been shipped for RHEL 8 the appliance can consume the fix via a regular yum update.

Affected upstream versions: Affects v9.6 to v14
Fixed upstream versions: REL9_6_24
Upstream repository: https://git.postgresql.org/gitweb/postgresql.git
Upstream fix commit: d83cdfdca9d918bbbd6bb209139b94c954da7228
CVE-2021-23362: nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()
Component: nodejs-hosted-git-info
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2021-03-23T00:00:00+00:00

A regular expression denial of service vulnerability was found in hosted-git-info. If an application allows user input into the affected regular expression (regexp) function, `shortcutMatch` or `fromUrl`, then an attacker could craft a regexp which takes an ever increasing amount of time to process, potentially resulting in a denial of service.

Statement: While some components do package a vulnerable version of hosted-git-info, access to them requires OpenShift OAuth credentials and hence have been marked with a Low impact. This applies to the following products:
  - OpenShift Container Platform (OCP)
  - OpenShift ServiceMesh (OSSM)
  - Red Hat Advanced Cluster Management for Kubernetes (RHACM)

Specifically the following components:
 - The OCP hive-container does ship the vulnerable component, however since OCP 4.6 the Metering product has been deprecated [1], set as wont-fix and may be fixed in a future release.

Red Hat Ceph Storage (RHCS) 4 packages a version of nodejs-hosted-git-info which is vulnerable to this flaw in the grafana-container shipped with it. 

Red Hat Quay includes hosted-git-info as a dependency of karma-coverage which is only used at development time. The hosted-git-info library is not used at runtime so the impact is low for Red Hat Quay.

Red Hat Virtualization includes a vulnerable version of hosted-git-info, however it is only used during development. The hosted-git-info library is not used at runtime thus impact is rated Low and marked as "wontfix" at this time. Future updates may address this flaw.

[1] - https://access.redhat.com/solutions/5707561

Affected upstream versions: unspecified < 3.0.8
Fixed upstream versions: 3.0.8
Upstream repository: https://github.com/npm/hosted-git-info
Upstream fix commit: bede0dc38e1785e732bf0a48ba6f81a4a908eba3
CVE-2021-23364: browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS)
Component: browserslist
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2021-04-28T00:00:00+00:00

Regular Expression Denial of Service (ReDoS)  vulnerability was found in browserslist library. An attacker can use this vulnerability to parse a query which potentially can lead to service degradation.

Statement: While some components do package a vulnerable version of nodejs browserslist library, access to them requires OpenShift OAuth credentials and hence have been marked with a Low impact. 
This applies to the following products:
  - OpenShift Container Platform (OCP)
  - OpenShift ServiceMesh (OSSM)
  - Red Hat Advanced Cluster Management for Kubernetes (RHACM)

In Red Had Quay , whilst a vulnerable version of `browserslist` is included in the quay-rhel8 container it is a development dependency only, therefor the impact is low.

Affected upstream versions: 4.0.0 < unspecified, unspecified < 4.16.5
Fixed upstream versions: 4.16.5, unspecified
Upstream repository: https://github.com/browserslist/browserslist
Upstream fix commit: c091916910dfe0b5fd61caad96083c6709b02d98
CVE-2021-23368: nodejs-postcss: Regular expression denial of service during source map parsing
Component: nodejs-postcss
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2021-04-12T00:00:00+00:00

A regular expression denial of service (ReDoS) vulnerability was found in the npm library `postcss`. When parsing a supplied CSS string, if it contains an unexpected value then as the supplied CSS grows in length it will take an ever increasing amount of time to process. An attacker can use this vulnerability to potentially craft a malicious a long CSS value to process resulting in a denial of service.

Statement: In Red Hat OpenShift Container Platform (RHOCP), OpenShift ServiceMesh (OSSM) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-postcss library to authenticated users only, therefore the impact is low.

Red Hat OpenShift Container Platform 4 delivers the kibana package where the nodejs-postcss library is used, but due to the code changing to the container first content the kibana package is marked as wontfix. This may be fixed in the future.

In Red Had Quay , whilst a vulnerable version of `postcss` is included in the quay-rhel8 container it is a development dependency only, therefor the impact is low.

In Red Hat Virtualization a vulnerable version of postcss is used in cockpit-ovirt, ovirt-web-ui and ovirt-engine-ui-extensions. However, it is only used during development and is used to process known CSS content. This flaw has been marked as "wontfix" and it may be addressed in future updates.

Affected upstream versions: 7.0.0 < unspecified, unspecified < 8.2.10
Fixed upstream versions: 8.2.10, unspecified
Upstream repository: https://github.com/postcss/postcss
Upstream fix commit: b6f3e4d5a8d7504d553267f80384373af3a3dec5
CVE-2021-23369: nodejs-handlebars: Remote code execution when compiling untrusted compile templates with strict:true option
Component: nodejs-handlebars
Severity: Moderate
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-04-12T00:00:00+00:00

A flaw was found in nodejs-handlebars. A missing check when getting prototype properties in the template function allows an attacker, who can provide untrusted handlebars templates, to execute arbitrary code in the javascript system (e.g. browser or server) when the template is compiled with the strict:true option. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: Red Hat OpenShift Container Platform (OCP) 4 delivers the kibana package which includes Handlebars.js. From OCP 4.6, the kibana package is no longer shipped and will not be fixed. 
The openshift4/ose-logging-kibana6 container includes Handlebars.js directly as container first code.

In OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) some components include the vulnerable handlebars library, but access is protected by OpenShift OAuth what reducing impact by this flaw to LOW.

Red Hat Quay includes Handlebars.js as a development dependency. It does not use Handlebars.js at runtime to process templates so have been given a low impact rating.

Red Hat Gluster Storage 3 bundles vulnerable Handlebars.js (with pcs), however it does not use "strict" option and templates from external sources, hence this issue has been rated as having a security impact of Low.

In Red Hat Virtualization ovirt-engine-ui-extensions and ovirt-web-ui Handlebars.js is included as a dependency of conventional-changelog-writer,  it does not impact production code and as such has been given a low impact rating and set to wontfix. Handlebars.js may be updated to a newer version in future updates.

Affected upstream versions: unspecified < 4.7.7
Fixed upstream versions: 4.7.7
Upstream repository: https://github.com/handlebars-lang/handlebars.js
Upstream fix commit: b6d3de7123eebba603e321f04afdbae608e8fea8
CVE-2021-23382: nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js
Component: nodejs-postcss
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2021-04-26T00:00:00+00:00

A regular expression denial of service (ReDoS) vulnerability was found in the npm library `postcss` when using getAnnotationURL() or loadAnnotation() options in lib/previous-map.js. An attacker can use this vulnerability to potentially craft a malicious CSS to process resulting in a denial of service.

Statement: In Red Hat OpenShift Container Platform (RHOCP), OpenShift ServiceMesh (OSSM) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-postcss library to authenticated users only, therefore the impact is low.

Red Hat OpenShift Container Platform 4 delivers the kibana package where the nodejs-postcss library is used, but due to the code changing to the container first content the kibana package is marked as wontfix. This may be fixed in the future.

In Red Had Quay , whilst a vulnerable version of `postcss` is included in the quay-rhel8 container it is a development dependency only, therefor the impact is low.

Affected upstream versions: unspecified < 8.2.13
Fixed upstream versions: 8.2.13
Upstream repository: https://github.com/postcss/postcss
Upstream fix commit: 2b1d04c867995e55124e0a165b7c6622c1735956
CVE-2021-23383: nodejs-handlebars: Remote code execution when compiling untrusted compile templates with compat:true option
Component: nodejs-handlebars
Severity: Moderate
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-04-12T00:00:00+00:00

A flaw was found in nodejs-handlebars. A unescaped value in the JavaScriptCompiler.prototype.depthedLookup function allows an attacker, who can provide untrusted handlebars templates, to execute arbitrary code in the javascript system (e.g. browser or server) when the template is compiled with the compat:true option. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: Red Hat OpenShift Container Platform (OCP) 4 delivers the kibana component which includes Handlebars.js.  Starting in 4.6, kibana is shipping as "container first" content.  As such, the fix for OCP will be seen in the affected products table under openshift4/ose-logging-kibana6.  The separate package "kibana" listed under "OpenShift Container Platform 4" is only used by 4.5 and earlier and will not be fixed.

In OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM) some components include the vulnerable handlebars library, but access is protected by OpenShift OAuth what reducing impact by this flaw to LOW.

Red Hat Quay includes Handlebars.js as a development dependency. It does not use Handlebars.js at runtime to process templates so have been given a low impact rating.

Red Hat Gluster Storage 3 bundles vulnerable Handlebars.js (with pcs), however it does not use "compat" option and templates from external sources, hence this issue has been rated as having a security impact of Low.

Affected upstream versions: unspecified < 4.7.7
Fixed upstream versions: 4.7.7
Upstream repository: https://github.com/handlebars-lang/handlebars.js
Upstream fix commit: f0589701698268578199be25285b2ebea1c1e427
CVE-2021-23434: object-path: Type confusion vulnerability can lead to a bypass of CVE-2020-15256
Component: object-path
Severity: Moderate
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2021-08-27T00:00:00+00:00

Prototype pollution has been discovered in object-path NodeJS library. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays.  In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.

Statement: * OpenShift Container Platform components Thanos and Prometheus shipped with versions before 4.8 had the affected object-path library. Those versions are out of the support scope for Moderate and Low impact vulnerabilities because they are already in the maintenance support phase, hence the affected components has been marked as ooss.

* Because Service Telemetry Framework1.2 will be retiring soon and the flaw's impact is lower, no update will be provided at this time for STF1.2's service-telemetry-operator-container and smart-gateway-operator-container.

Affected upstream versions: unspecified < 0.11.6
Fixed upstream versions: 0.11.6
Upstream repository: https://github.com/mariocasciaro/object-path
Upstream fix commit: 7bdf4abefd102d16c163d633e8994ef154cab9eb
CVE-2021-23436: immer: type confusion vulnerability can lead to a bypass of CVE-2020-28477
Component: immer
Severity: Important
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-09-01T00:00:00+00:00

A prototype pollution flaw was found in the Node.js immer module. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, an attacker could execute arbitrary code on the system.


Affected upstream versions: unspecified < 9.0.6
Fixed upstream versions: 9.0.6
Upstream repository: https://github.com/immerjs/immer
Upstream fix commit: fa671e55ee9bd42ae08cc239102b665a23958237
CVE-2021-23440: nodejs-set-value: type confusion allows bypass of CVE-2019-10747
Component: nodejs-set-value
Severity: Moderate
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2021-09-12T00:00:00+00:00

A type confusion vulnerability in nodejs-set-value can lead to a bypass of CVE-2019-10747. If the user-provided keys used in the path parameter are arrays, the function mixin-deep can be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or _proto_ payloads. This vulnerability can impact data confidentiality, integrity, and availability.


Affected upstream versions: <2.0.1, >=3.0.0 <4.0.1
Fixed upstream versions: 4.0.1
Upstream repository: https://github.com/jonschlinkert/set-value
Upstream fix commit: 7cf8073bb06bf0c15e08475f9f952823b4576452