huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2021-4156: libsndfile: heap out-of-bounds read in src/flac.c in flac_buffer_copy
Component: libsndfile
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Public date: 2021-04-13T00:00:00+00:00

An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.

Statement: This flaw is out of support scope for libsndfile shipped with Red Hat Enterprise Linux 6 and 7.

Affected upstream versions: libsndfile 1.1.0
Upstream repository: https://github.com/libsndfile/libsndfile
Upstream fix commit: 4c30646abf7834e406f7e2429c70bc254e18beab
CVE-2021-4158: QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c
Component: QEMU
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Public date: 2021-12-12T00:00:00+00:00

A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.

Statement: Releases of Red Hat OpenStack Platform 15 and newer, Red Hat Virtualization 4.4 and newer consume fixes directly from the Red Hat Enterprise Linux 8 Advanced Virtualization repository.

Affected upstream versions: Affects v6.0.0 and above.
Fixed upstream versions: v7.0.0
Upstream repository: https://gitlab.com/qemu-project/qemu
Upstream fix commit: 9bd6565ccee68f72d5012e24646e12a1c662827e
CVE-2021-41864: kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-09-30T00:00:00+00:00

An out-of-bounds (OOB) memory write flaw was found in prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the bpf in the Linux kernel. In this flaw, the multiplication to calculate the size could lead to an integer overflow which could allow a local attacker, with a special user privilege, to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information.

Statement: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.

For the Red Hat Enterprise Linux 7 the eBPF for unprivileged users is always disabled.
For the Red Hat Enterprise Linux 8 to confirm the current state, inspect the sysctl with the command:
~~~
# cat /proc/sys/kernel/unprivileged_bpf_disabled
~~~
The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.

A kernel update will be required to mitigate the flaw for the root or users with CAP_SYS_ADMIN capabilities.

Affected upstream versions: n/a
Fixed upstream versions: v5.15
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 30e29a9a2bc6a4888335a6ede968b75cd329657a
CVE-2021-4189: python: ftplib should not use the host from the PASV response
Component: python
Severity: Moderate
CWE: CWE-252 (Unchecked Return Value)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2021-12-21T00:00:00+00:00

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.


Affected upstream versions: Fixed in python 3.6.14, python 3.7.11, python 3.8.9, python 3.9.3, python 3.10.0
Fixed upstream versions: v3.10.0
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 0ab152c6b5d95caa2dc1a30fa96e10258b5f188e
CVE-2021-4192: vim: use-after-free in win_linetabsize()
Component: vim
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2021-12-31T00:00:00+00:00

It was found that vim was vulnerable to use-after-free flaw in win_linetabsize(). Sourcing a specially crafted file in vim could crash the vim process or possibly lead to other undefined behaviors.


Affected upstream versions: unspecified < 8.2
Fixed upstream versions: 8.2
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 4c13e5e6763c6eb36a343a2b8235ea227202e952
CVE-2021-4193: vim: out-of-bound read in getvcol()
Component: vim
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2021-12-31T00:00:00+00:00

It was found that vim was vulnerable to an out-of-bound read flaw in getvcol(). A specially crafted file could be used to, when opened in vim, disclose some of the process's internal memory.


Affected upstream versions: unspecified < 8.2.3901
Fixed upstream versions: 8.2.3901
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 94f3192b03ed27474db80b4d3a409e107140738b
CVE-2021-4203: kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses
Component: kernel
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L)
Public date: 2021-09-29T00:00:00+00:00

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect())  in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information.


Affected upstream versions: kernel 5.15 rc4
Fixed upstream versions: v5.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
Upstream fix commit: 35306eb23814
CVE-2021-4213: JSS: memory leak in TLS connection leads to OOM
Component: JSS
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-02-09T00:00:00+00:00

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.


Affected upstream versions: Fixed in v5.2.0-beta1
Fixed upstream versions: v5.2.0
Upstream repository: https://github.com/dogtagpki/jss
Upstream fix commit: 5922560a78d0dee61af8a33cc9cfbf4cfa291448
CVE-2021-4231: angular: XSS vulnerability
Component: angular
Severity: Low
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 3.9 (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L)
Public date: 2020-12-15T00:00:00+00:00

A flaw was found in the angular/core package. Affected versions of this package are vulnerable to Cross-site scripting (XSS) in development, with Server-side rendering (SSR enabled).

Statement: This flaw is out of support scope for dotnet-5.0, therefore it will not be addressed in this version of dotnet. For more information, please see https://access.redhat.com/support/policy/updates/net-core.

Affected upstream versions: 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.1.0-next.0, 11.1.0-next.1, 11.1.0-next.2
Fixed upstream versions: 10.2.5
Upstream repository: https://github.com/angular/angular
Upstream fix commit: ba8da742e3b243e8f43d4c63aa842b44e14f2b09
CVE-2021-4235: go-yaml: Denial of Service in go-yaml
Component: go-yaml
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2022-12-27T00:00:00+00:00

A flaw was found in go-yaml. This issue occurs due to unbounded alias chasing, where a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.


Affected upstream versions: <= v2.2.2
Fixed upstream versions: 2.2.3
Upstream repository: https://github.com/go-yaml/yaml
Upstream fix commit: bb4e33bf68bf89cad44d386192cbed201f35b241
CVE-2021-4238: goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be
Component: goutils
Severity: Important
CWE: CWE-331 (Insufficient Entropy)
CVSS v3: 7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L)
Public date: 2022-12-27T00:00:00+00:00

A flaw was found in goutils where randomly generated alphanumeric strings contain significantly less entropy than expected. Both the `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric` functions always return strings containing at least one digit from 0 to 9. This issue significantly reduces the amount of entropy generated in short strings by these functions.


Affected upstream versions: <= v1.1.0
Fixed upstream versions: 1.1.1
Upstream repository: https://github.com/Masterminds/goutils
Upstream fix commit: 869801f20f9f1e7ecdbdb6422049d8241270d5e1
CVE-2021-42739: kernel: Heap buffer overflow in firedtv driver
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-04-20T00:00:00+00:00

A heap-based buffer overflow flaw was found in the Linux kernel FireDTV media card driver, where the user calls the CA_SEND_MSG ioctl. This flaw allows a local user of the host machine to crash the system or escalate privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
CVE-2021-4294: osin: manipulation of the argument secret leads to observable timing discrepancy
Component: osin
Severity: Moderate
CWE: CWE-208 (Observable Timing Discrepancy)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-12-28T00:00:00+00:00

A vulnerability was found in OpenShift OSIN. This issue affects the ClientSecretMatches/CheckClientSecret function, where the manipulation of the argument secret leads to an observable timing discrepancy.


Affected upstream versions: n/a
Upstream repository: https://github.com/openshift/osin
Upstream fix commit: 8612686d6dda34ae9ef6b5a974e4b7accb4fea29
CVE-2021-43056: kernel: ppc: kvm: allows a malicious KVM guest to crash the host
Component: kernel
Severity: Moderate
CWE: CWE-252 (Unchecked Return Value)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-10-25T00:00:00+00:00

A denial of service problem was found in the Linux kernel's Kernel-based Virtual Machine (KVM) specific to PowerPC. In this flaw, a user with local access can confuse the host offline code, causing the guest to crash.


Affected upstream versions: n/a
Fixed upstream versions: v5.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
CVE-2021-43138: async: Prototype Pollution in async
Component: async
Severity: Moderate
CWE: CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2022-04-07T00:00:00+00:00

A vulnerability was found in the async package. This flaw allows a malicious user to obtain privileges via the mapValues() method.


Affected upstream versions: n/a
Fixed upstream versions: v3.2.2
Upstream repository: https://github.com/caolan/async
Upstream fix commit: e1ecdbf79264f9ab488c7799f4c76996d5dca66d
CVE-2021-43267: kernel: Insufficient validation of user-supplied sizes for the MSG_CRYPTO message type
Component: kernel
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-11-02T00:00:00+00:00

A flaw was discovered in the cryptographic receive code in the Linux kernel's implementation of transparent interprocess communication. An attacker, with the ability to send TIPC messages to the target, can corrupt memory and escalate privileges on the target system.

Statement: This issue affects Red Hat Enterprise Linux 8 starting with the kernel that shipped with Red Hat Enterprise Linux 8.4 GA (kernel-4.18.0-305.el8). Previous Red Hat Enterprise Linux 8 kernel versions were not affected as they did not include the vulnerable functionality.

Red Hat recommends to use transport level to separate and/or secure (by both encrypting and authenticating via eg. IPSec/MACSec) the communication between nodes. This limits the exposure of this issue to semi-trusted nodes.

Affected upstream versions: n/a
Fixed upstream versions: v5.15
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: fa40d9734a57bcbfa79a280189799f76c88f7bb0
CVE-2021-43389: kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-09-24T00:00:00+00:00

An improper validation of an array index and out of bounds memory read in the Linux kernel's Integrated Services Digital Network (ISDN) functionality was found in the way users call ioctl CMTPCONNADD. A local user could use this flaw to crash the system or starve the resources causing denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v5.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 1f3e2e97c003f80c4b087092b225c8787ff91e4d
CVE-2021-43612: lldpd: out-of-bounds read when decoding SONMP packets
Component: lldpd
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.3 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2021-11-18T00:00:00+00:00

An out-of-bounds read vulnerability is present in lldpd. An attacker on the same network as the vulnerable system may use this vulnerability to leak memory data from the application or crash it by sending shorter SONMP packets than what is expected.

Statement: The Impact of this flaw has been set to Moderate, as it generally results in leak of data or, in some particular circumstances, in a crash of the application. Moreover, it requires an attacker to be adjacent to the vulnerable system.

Affected upstream versions: n/a
Fixed upstream versions: 1.0.13
Upstream repository: https://github.com/lldpd/lldpd
Upstream fix commit: 73d42680fce8598324364dbb31b9bc3b8320adf7
CVE-2021-43616: npm: npm ci succeeds when package-lock.json doesn't match package.json
Component: npm
Severity: Important
CWE: CWE-345 (Insufficient Verification of Data Authenticity)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-02-15T00:00:00+00:00

A flaw was found in npm. The npm ci command proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json.

Statement: Several nodejs modules in Red Hat Enterprise Linux 8 and software collections for Red Hat Enterprise Linux 7 are not affected by this flaw. This is because the vulnerability was never present in the 6.x version of npm in use by these products.

Red Hat's Secure Software Development Life Cycle utilizes a layered testing approach. This significantly increases attack complexity, because a compromised package must remain undetected for months to years in testing in upstream communities before it could be adopted into a Red Hat product. This long dwell-time reduces impact to Important.

Affected upstream versions: n/a
Fixed upstream versions: libnpmfund@3.0.0
Upstream repository: https://github.com/npm/cli
Upstream fix commit: 457e0ae61bbc55846f5af44afa4066921923490f
CVE-2021-43618: gmp: Integer overflow and resultant buffer overflow via crafted input
Component: gmp
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-11-15T00:00:00+00:00

A flaw was found in gmp. An integer overflow vulnerability could allow an attacker to input an integer value leading to a crash. The highest threat from this vulnerability is to system availability.

Statement: Exploitation is only possible on 32-bit systems. The susceptible GMP package is not tethered to the network stack, so it can only be exploited via a file already on the local system. This can be achieved either by the attacker gaining local login credentials or alternatively; by tricking a user into loading then executing a malicious file. Because of these combined reasons Red Hat Product Security rates the impact as Moderate.

Affected upstream versions: n/a
Upstream repository: https://gmplib.org/repo/gmp-6.2
Upstream fix commit: 561a9c25298e
CVE-2021-43784: runc: integer overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration
Component: runc
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2021-12-06T00:00:00+00:00

An integer overflow vulnerability was found in runC. This issue occurs due to an incorrect netlink encoder handling the possibility of an integer overflow in the 16-bit length field for the byte array attribute type. This flaw allows an attacker who can include a large enough malicious byte array attribute to bypass the namespace restrictions of the container by simply adding their netlink payload, which disables all namespaces.

Statement: Before runC 1.0.3, the only user-controlled byte array (used to exploit this vulnerability) was the namespace paths attributes, located in runC's config.json. Having raw access to that setting would allow the attacker to disable namespace protections entirely. This issue means that in practice, it was fairly difficult to specify an arbitrary-length netlink message with most container runtimes, resulting in the impact of this vulnerability being Low.

Affected upstream versions: < 1.0.3
Fixed upstream versions: v1.1.0
Upstream repository: https://github.com/opencontainers/runc
Upstream fix commit: 9c444070ec7bb83995dbc0185da68284da71c554
CVE-2021-43797: netty: control chars in header names may lead to HTTP request smuggling
Component: netty
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Public date: 2021-12-09T00:00:00+00:00

A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling.

Statement: In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec-http package.
Since the release of OCP 4.6, the Metering product has been deprecated, hence the affected components are marked as wontfix.
The openshift4/ose-logging-elasticsearch6 container is marked as Out of support scope because since the release of OCP 4.7 the logging functionality is delivered as an OpenShift Logging product and OCP 4.6 is already in the Maintenance Support phase.
A fix was introduced in netty-codec-http version 4.1.72.Final.

Affected upstream versions: <= 4.1.7.0.Final
Fixed upstream versions: netty-4.1.71.Final
Upstream repository: https://github.com/netty/netty
Upstream fix commit: 07aa6b5938a8b6ed7a6586e066400e2643897323
CVE-2021-43809: rubygem-bundler: unexpected code execution in Gemfiles
Component: rubygem-bundler
Severity: Moderate
CWE: CWE-88 (Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'))
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2021-12-08T00:00:00+00:00

`Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the `Gemfile` itself. However, if the `Gemfile` includes `gem` entries that use the `git` option with invalid, but seemingly harmless, values with a leading dash, this can be false. To handle dependencies that come from a Git repository instead of a registry, Bundler uses various commands, such as `git clone`. These commands are being constructed using user input (e.g. the repository URL). When building the commands, Bundler versions before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (`-`) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables. Since this value comes from the `Gemfile` file, it can contain any character, including a leading dash.

To exploit this vulnerability, an attacker has to craft a directory containing a `Gemfile` file that declares a dependency that is located in a Git repository. This dependency has to have a Git URL in the form of `-u./payload`. This URL will be used to construct a Git clone command but will be interpreted as the upload-pack argument. Then this directory needs to be shared with the victim, who then needs to run a command that evaluates the Gemfile, such as `bundle lock`, inside.

This vulnerability can lead to Arbitrary Code Execution, which could potentially lead to the takeover of the system. However, the exploitability is very low, because it requires a lot of user interaction. Bundler 2.2.33 has patched this problem by inserting `--` as an argument before any positional arguments to those Git commands that were affected by this issue. Regardless of whether users can upgrade or not, they should review any untrustred `Gemfile`'s before running any `bundler` commands that may read them, since they can contain arbitrary ruby code.


Affected upstream versions: < 2.2.33
Fixed upstream versions: bundler-v2.3.0
Upstream repository: https://github.com/rubygems/rubygems
Upstream fix commit: 0fad1ccfe9dd7a3c5b82c1496df3c2b4842870d3