rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.
Vulnerability ID: CVE-2021-37750
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/krb5/krb5
Published: 2021-08-23
File: src/kdc/do_tgs_req.c
Commit message: Fix KDC null deref on TGS inner body null server

After the KDC decodes a FAST inner body, it does not check for a null
server.  Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this
would typically result in an error from krb5_unparse_name(), but with
the addition of get_local_tgt() it results in a null dereference.  Add
a null check.

Reported by Joseph Sutton of Catalyst.

CVE-2021-37750:

In MIT krb5 releases 1.14 and later, an authenticated attacker can
cause a null dereference in the KDC by sending a FAST TGS request with
no server field.

ticket: 9008 (new)
tags: pullup
target_version: 1.19-next
target_version: 1.18-next
Commit author: Greg Hudson

Vulnerable version (before fix):
 process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,         status = "FIND_FAST";         goto cleanup;     }      errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server,                             &local_tgt, &local_tgt_storage, &local_tgt_key);

Fixed version (after fix):
 process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,         status = "FIND_FAST";         goto cleanup;     }     if (sprinc == NULL) {         status = "NULL_SERVER";         errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;         goto cleanup;     }      errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server,                             &local_tgt, &local_tgt_storage, &local_tgt_key);

Patch:
patch: @@ -204,6 +204,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
         status = "FIND_FAST";
         goto cleanup;
     }
+    if (sprinc == NULL) {
+        status = "NULL_SERVER";
+        errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
+        goto cleanup;
+    }
 
     errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server,
                             &local_tgt, &local_tgt_storage, &local_tgt_key);
path: src/kdc/do_tgs_req.c
Vulnerability: A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger malicious OS commands on the server running the FileBrowser instance.
Vulnerability ID: CVE-2021-37794
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/filebrowser/filebrowser
Published: 2021-08-31
File: http/http.go
Commit message: chore: add Content-Security-Policy header
Commit author: Oleg Lobanov

Vulnerable version (before fix):
 func NewHandler( 	server.Clean()  	r := mux.NewRouter() 	index, static := getStaticHandlers(store, server, assetsFs)  	// NOTE: This fixes the issue where it would redirect if people did not put a

Fixed version (after fix):
 func NewHandler( 	server.Clean()  	r := mux.NewRouter() 	r.Use(func(next http.Handler) http.Handler { 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 			w.Header().Set("Content-Security-Policy", `default-src 'self'`) 			next.ServeHTTP(w, r) 		}) 	}) 	index, static := getStaticHandlers(store, server, assetsFs)  	// NOTE: This fixes the issue where it would redirect if people did not put a

Patch:
patch: @@ -25,6 +25,12 @@ func NewHandler(
 	server.Clean()
 
 	r := mux.NewRouter()
+	r.Use(func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Content-Security-Policy", `default-src 'self'`)
+			next.ServeHTTP(w, r)
+		})
+	})
 	index, static := getStaticHandlers(store, server, assetsFs)
 
 	// NOTE: This fixes the issue where it would redirect if people did not put a
path: http/http.go
Vulnerability: Joplin before 2.0.9 allows XSS via button and form in the note body.
Vulnerability ID: CVE-2021-37916
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/laurent22/joplin
Published: 2021-08-03
File: packages/renderer/htmlUtils.ts
Commit message: Desktop, Mobile: Filter out form elements from note body to prevent potential XSS (thanks to Dmytro Vdovychinskiy for the PoC)
Commit author: Laurent Cozic

Vulnerable version (before fix):
 class HtmlUtils { 		// "link" can be used to escape the parser and inject JavaScript. 		// Adding "meta" too for the same reason as it shouldn't be used in 		// notes anyway. 		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript'];  		const parser = new htmlparser2.Parser({ 

Fixed version (after fix):
 class HtmlUtils { 		// "link" can be used to escape the parser and inject JavaScript. 		// Adding "meta" too for the same reason as it shouldn't be used in 		// notes anyway. 		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript', 'button', 'form', 'input', 'select', 'textarea', 'option', 'optgroup'];  		const parser = new htmlparser2.Parser({ 

Patch:
patch: @@ -158,7 +158,7 @@ class HtmlUtils {
 		// "link" can be used to escape the parser and inject JavaScript.
 		// Adding "meta" too for the same reason as it shouldn't be used in
 		// notes anyway.
-		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript'];
+		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript', 'button', 'form', 'input', 'select', 'textarea', 'option', 'optgroup'];
 
 		const parser = new htmlparser2.Parser({
path: packages/renderer/htmlUtils.ts
Vulnerability: read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
Vulnerability ID: CVE-2021-38115
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/libgd/libgd
Published: 2021-08-04
File: src/gd_tga.c
Commit message: fix read out-of-bands in reading tga header file
Commit author: maryam ebrahimzadeh

Vulnerable version (before fix):
 int read_header_tga(gdIOCtx *ctx, oTga *tga) 			return -1; 		}  		gdGetBuf(tga->ident, tga->identsize, ctx); 	}  	return 1;

Fixed version (after fix):
 int read_header_tga(gdIOCtx *ctx, oTga *tga) 			return -1; 		}  		 		if (gdGetBuf(tga->ident, tga->identsize, ctx) != tga->identsize) { 			gd_error("fail to read header ident"); 			return -1; 		} 	}  	return 1;

Patch:
patch: @@ -191,7 +191,11 @@ int read_header_tga(gdIOCtx *ctx, oTga *tga)
 			return -1;
 		}
 
-		gdGetBuf(tga->ident, tga->identsize, ctx);
+		
+		if (gdGetBuf(tga->ident, tga->identsize, ctx) != tga->identsize) {
+			gd_error("fail to read header ident");
+			return -1;
+		}
 	}
 
 	return 1;
path: src/gd_tga.c
Vulnerability: ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior.
Vulnerability ID: CVE-2021-38160
CWE: CWE-120
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2021-08-07
File: drivers/char/virtio_console.c
Commit message: virtio_console: Assure used length from device is limited

The buf->len might come from an untrusted device. This
ensures the value would not exceed the size of the buffer
to avoid data corruption or loss.

Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/20210525125622.1203-1-xieyongji@bytedance.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Commit author: Xie Yongji

Vulnerable version (before fix):
 static struct port_buffer *get_inbuf(struct port *port)  	buf = virtqueue_get_buf(port->in_vq, &len); 	if (buf) { 		buf->len = len; 		buf->offset = 0; 		port->stats.bytes_received += len; 	} static void control_work_handler(struct work_struct *work) 	while ((buf = virtqueue_get_buf(vq, &len))) { 		spin_unlock(&portdev->c_ivq_lock);  		buf->len = len; 		buf->offset = 0;  		handle_control_message(vq->vdev, portdev, buf);

Fixed version (after fix):
 static struct port_buffer *get_inbuf(struct port *port)  	buf = virtqueue_get_buf(port->in_vq, &len); 	if (buf) { 		buf->len = min_t(size_t, len, buf->size); 		buf->offset = 0; 		port->stats.bytes_received += len; 	} static void control_work_handler(struct work_struct *work) 	while ((buf = virtqueue_get_buf(vq, &len))) { 		spin_unlock(&portdev->c_ivq_lock);  		buf->len = min_t(size_t, len, buf->size); 		buf->offset = 0;  		handle_control_message(vq->vdev, portdev, buf);

Patch:
patch: @@ -475,7 +475,7 @@ static struct port_buffer *get_inbuf(struct port *port)
 
 	buf = virtqueue_get_buf(port->in_vq, &len);
 	if (buf) {
-		buf->len = len;
+		buf->len = min_t(size_t, len, buf->size);
 		buf->offset = 0;
 		port->stats.bytes_received += len;
 	}
@@ -1709,7 +1709,7 @@ static void control_work_handler(struct work_struct *work)
 	while ((buf = virtqueue_get_buf(vq, &len))) {
 		spin_unlock(&portdev->c_ivq_lock);
 
-		buf->len = len;
+		buf->len = min_t(size_t, len, buf->size);
 		buf->offset = 0;
 
 		handle_control_message(vq->vdev, portdev, buf);
path: drivers/char/virtio_console.c
Vulnerability: arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perf_event_paranoid=-1 and no specific PMU driver support registered, allows local users to cause a denial of service (perf_instruction_pointer NULL pointer dereference and OOPS) via a "perf record" command.
Vulnerability ID: CVE-2021-38200
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2021-08-08
File: arch/powerpc/perf/core-book3s.c
Commit message: powerpc/perf: Fix crash in perf_instruction_pointer() when ppmu is not set

On systems without any specific PMU driver support registered, running
perf record causes Oops.

The relevant portion from call trace:

  BUG: Kernel NULL pointer dereference on read at 0x00000040
  Faulting instruction address: 0xc0021f0c
  Oops: Kernel access of bad area, sig: 11 [#1]
  BE PAGE_SIZE=4K PREEMPT CMPCPRO
  SAF3000 DIE NOTIFICATION
  CPU: 0 PID: 442 Comm: null_syscall Not tainted 5.13.0-rc6-s3k-dev-01645-g7649ee3d2957 #5164
  NIP:  c0021f0c LR: c00e8ad8 CTR: c00d8a5c
  NIP perf_instruction_pointer+0x10/0x60
  LR  perf_prepare_sample+0x344/0x674
  Call Trace:
    perf_prepare_sample+0x7c/0x674 (unreliable)
    perf_event_output_forward+0x3c/0x94
    __perf_event_overflow+0x74/0x14c
    perf_swevent_hrtimer+0xf8/0x170
    __hrtimer_run_queues.constprop.0+0x160/0x318
    hrtimer_interrupt+0x148/0x3b0
    timer_interrupt+0xc4/0x22c
    Decrementer_virt+0xb8/0xbc

During perf record session, perf_instruction_pointer() is called to
capture the sample IP. This function in core-book3s accesses
ppmu->flags. If a platform specific PMU driver is not registered, ppmu
is set to NULL and accessing its members results in a crash. Fix this
crash by checking if ppmu is set.

Fixes: 2ca13a4cc56c ("powerpc/perf: Use regs->nip when SIAR is zero")
Cc: stable@vger.kernel.org # v5.11+
Reported-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Tested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1623952506-1431-1-git-send-email-atrajeev@linux.vnet.ibm.com
Commit author: Athira Rajeev

Vulnerable version (before fix):
 unsigned long perf_instruction_pointer(struct pt_regs *regs) 	bool use_siar = regs_use_siar(regs); 	unsigned long siar = mfspr(SPRN_SIAR);  	if (ppmu->flags & PPMU_P10_DD1) { 		if (siar) 			return siar; 		else

Fixed version (after fix):
 unsigned long perf_instruction_pointer(struct pt_regs *regs) 	bool use_siar = regs_use_siar(regs); 	unsigned long siar = mfspr(SPRN_SIAR);  	if (ppmu && (ppmu->flags & PPMU_P10_DD1)) { 		if (siar) 			return siar; 		else

Patch:
patch: @@ -2254,7 +2254,7 @@ unsigned long perf_instruction_pointer(struct pt_regs *regs)
 	bool use_siar = regs_use_siar(regs);
 	unsigned long siar = mfspr(SPRN_SIAR);
 
-	if (ppmu->flags & PPMU_P10_DD1) {
+	if (ppmu && (ppmu->flags & PPMU_P10_DD1)) {
 		if (siar)
 			return siar;
 		else
path: arch/powerpc/perf/core-book3s.c
Vulnerability: net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.
Vulnerability ID: CVE-2021-38201
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2021-08-08
File: net/sunrpc/xdr.c
Commit message: sunrpc: Avoid a KASAN slab-out-of-bounds bug in xdr_set_page_base()

This seems to happen fairly easily during READ_PLUS testing on NFS v4.2.
I found that we could end up accessing xdr->buf->pages[pgnr] with a pgnr
greater than the number of pages in the array. So let's just return
early if we're setting base to a point at the end of the page data and
let xdr_set_tail_base() handle setting up the buffer pointers instead.

Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Fixes: 8d86e373b0ef ("SUNRPC: Clean up helpers xdr_set_iov() and xdr_set_page_base()")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Commit author: Anna Schumaker

Vulnerable version (before fix):
 static unsigned int xdr_set_page_base(struct xdr_stream *xdr, 	void *kaddr;  	maxlen = xdr->buf->page_len; 	if (base >= maxlen) { 		base = maxlen; 		maxlen = 0; 	} else 		maxlen -= base; 	if (len > maxlen) 		len = maxlen;

Fixed version (after fix):
 static unsigned int xdr_set_page_base(struct xdr_stream *xdr, 	void *kaddr;  	maxlen = xdr->buf->page_len; 	if (base >= maxlen) 		return 0; 	else 		maxlen -= base; 	if (len > maxlen) 		len = maxlen;

Patch:
patch: @@ -1230,10 +1230,9 @@ static unsigned int xdr_set_page_base(struct xdr_stream *xdr,
 	void *kaddr;
 
 	maxlen = xdr->buf->page_len;
-	if (base >= maxlen) {
-		base = maxlen;
-		maxlen = 0;
-	} else
+	if (base >= maxlen)
+		return 0;
+	else
 		maxlen -= base;
 	if (len > maxlen)
 		len = maxlen;
path: net/sunrpc/xdr.c
Vulnerability: drivers/net/ethernet/xilinx/ll_temac_main.c in the Linux kernel before 5.12.13 allows remote attackers to cause a denial of service (buffer overflow and lockup) by sending heavy network traffic for about ten minutes.
Vulnerability ID: CVE-2021-38207
CWE: CWE-120
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2021-08-08
File: drivers/net/ethernet/xilinx/ll_temac_main.c
Commit message: net: ll_temac: Fix TX BD buffer overwrite

Just as the initial check, we need to ensure num_frag+1 buffers available,
as that is the number of buffers we are going to use.

This fixes a buffer overflow, which might be seen during heavy network
load. Complete lockup of TEMAC was reproducible within about 10 minutes of
a particular load.

Fixes: 84823ff80f74 ("net: ll_temac: Fix race condition causing TX hang")
Cc: stable@vger.kernel.org # v5.4+
Signed-off-by: Esben Haabendal <esben@geanix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Esben Haabendal

Vulnerable version (before fix):
 temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) 		smp_mb();  		/* Space might have just been freed - check again */ 		if (temac_check_tx_bd_space(lp, num_frag)) 			return NETDEV_TX_BUSY;  		netif_wake_queue(ndev);

Fixed version (after fix):
 temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) 		smp_mb();  		/* Space might have just been freed - check again */ 		if (temac_check_tx_bd_space(lp, num_frag + 1)) 			return NETDEV_TX_BUSY;  		netif_wake_queue(ndev);

Patch:
patch: @@ -861,7 +861,7 @@ temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 		smp_mb();
 
 		/* Space might have just been freed - check again */
-		if (temac_check_tx_bd_space(lp, num_frag))
+		if (temac_check_tx_bd_space(lp, num_frag + 1))
 			return NETDEV_TX_BUSY;
 
 		netif_wake_queue(ndev);
path: drivers/net/ethernet/xilinx/ll_temac_main.c
Vulnerability: gnuboard5 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability ID: CVE-2021-3831
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/gnuboard/gnuboard5
Published: 2021-12-14
File: bbs/memo.php
Commit message: $kind 변수를 이용한 XSS 취약점 수정 (Pocas님,211214)
Commit author: kagla

Vulnerable version (before fix):
     $unkind = 'send'; else if ($kind == 'send')     $unkind = 'recv'; else     alert(''.$kind .'값을 넘겨주세요.');  if ($page < 1) { $page = 1; } // 페이지가 없으면 첫 페이지 (1 페이지) 

Fixed version (after fix):
     $unkind = 'send'; else if ($kind == 'send')     $unkind = 'recv'; else {     $kind = clean_xss_tags(trim($kind));     alert(''.$kind .'값을 넘겨주세요.'); }  if ($page < 1) { $page = 1; } // 페이지가 없으면 첫 페이지 (1 페이지) 

Patch:
patch: @@ -15,8 +15,10 @@
     $unkind = 'send';
 else if ($kind == 'send')
     $unkind = 'recv';
-else
+else {
+    $kind = clean_xss_tags(trim($kind));
     alert(''.$kind .'값을 넘겨주세요.');
+}
 
 if ($page < 1) { $page = 1; } // 페이지가 없으면 첫 페이지 (1 페이지)
path: bbs/memo.php
Vulnerability: firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
Vulnerability ID: CVE-2021-3846
CWE: CWE-434
Severity score: 6.4
Project: https://github.com/firefly-iii/firefly-iii
Published: 2021-10-19
File: app/Helpers/Attachments/AttachmentHelper.php
Commit message: Make sure temp file is closed (and thus deleted)
Commit author: James Cole

Vulnerable version (before fix):
 public function saveAttachmentFromApi(Attachment $attachment, string $content):         $allowedMime = config('firefly.allowedMimes');         if (!in_array($mime, $allowedMime, true)) {             Log::error(sprintf('Mime type %s is not allowed for API file upload.', $mime));              return false;         }

Fixed version (after fix):
 public function saveAttachmentFromApi(Attachment $attachment, string $content):         $allowedMime = config('firefly.allowedMimes');         if (!in_array($mime, $allowedMime, true)) {             Log::error(sprintf('Mime type %s is not allowed for API file upload.', $mime));             fclose($resource);              return false;         }

Patch:
patch: @@ -171,6 +171,7 @@ public function saveAttachmentFromApi(Attachment $attachment, string $content):
         $allowedMime = config('firefly.allowedMimes');
         if (!in_array($mime, $allowedMime, true)) {
             Log::error(sprintf('Mime type %s is not allowed for API file upload.', $mime));
+            fclose($resource);
 
             return false;
         }
path: app/Helpers/Attachments/AttachmentHelper.php
Vulnerability: libmobi is vulnerable to Use of Out-of-range Pointer Offset
Vulnerability ID: CVE-2021-3888
CWE: CWE-119
Severity score: 4.9
Project: https://github.com/bfabiszewski/libmobi
Published: 2021-10-19
File: src/read.c
Commit message: Fix potential out-of-buffer read while parsing corrupt file, closes #38
Commit author: Bartek Fabiszewski

Vulnerable version (before fix):
 MOBI_RET mobi_parse_huffdic(const MOBIData *m, MOBIHuffCdic *huffcdic) {         }         curr = curr->next;     }     return MOBI_SUCCESS; } 

Fixed version (after fix):
 MOBI_RET mobi_parse_huffdic(const MOBIData *m, MOBIHuffCdic *huffcdic) {         }         curr = curr->next;     }     if (huffcdic->index_count != huffcdic->index_read) {         debug_print("CDIC: wrong read index count: %zu, total: %zu\n", huffcdic->index_read, huffcdic->index_count);         return MOBI_DATA_CORRUPT;     }     return MOBI_SUCCESS; } 

Patch:
patch: @@ -752,6 +752,10 @@ MOBI_RET mobi_parse_huffdic(const MOBIData *m, MOBIHuffCdic *huffcdic) {
         }
         curr = curr->next;
     }
+    if (huffcdic->index_count != huffcdic->index_read) {
+        debug_print("CDIC: wrong read index count: %zu, total: %zu\n", huffcdic->index_read, huffcdic->index_count);
+        return MOBI_DATA_CORRUPT;
+    }
     return MOBI_SUCCESS;
 }
path: src/read.c
Vulnerability: bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
Vulnerability ID: CVE-2021-3906
CWE: CWE-434
Severity score: 2.9
Project: https://github.com/bookstackapp/bookstack
Published: 2021-10-27
File: app/Uploads/ImageRepo.php
Commit message: Update ImageRepo.php

fix image validation vulnerability
Commit author: Haxatron

Vulnerable version (before fix):
 public function __construct(      */     public function imageExtensionSupported(string $extension): bool     {         return in_array(trim($extension, '. \t\n\r\0\x0B'), static::$supportedExtensions);     }      /**

Fixed version (after fix):
 public function __construct(      */     public function imageExtensionSupported(string $extension): bool     {         return in_array(trim($extension, ". \t\n\r\0\x0B"), static::$supportedExtensions);     }      /**

Patch:
patch: @@ -38,7 +38,7 @@ public function __construct(
      */
     public function imageExtensionSupported(string $extension): bool
     {
-        return in_array(trim($extension, '. \t\n\r\0\x0B'), static::$supportedExtensions);
+        return in_array(trim($extension, ". \t\n\r\0\x0B"), static::$supportedExtensions);
     }
 
     /**
path: app/Uploads/ImageRepo.php
Vulnerability: MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value.
Vulnerability ID: CVE-2021-39302
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/MISP/MISP
Published: 2021-08-19
File: app/Model/Log.php
Commit message: security: fix unescaped parameter leading to sqli
Commit author: Luciano Righetti

Vulnerable version (before fix):
 public function returnDates($org = 'all')             // cakephp ORM would escape "DATE" datatype in CAST expression             $condnotinaction = "'" . implode("', '", $conditions['AND']['NOT']['action']) . "'";             if (!empty($conditions['org'])) {                 $condOrg = ' AND org = "' . $conditions['org'] . '"';             } else {                 $condOrg = '';             }

Fixed version (after fix):
 public function returnDates($org = 'all')             // cakephp ORM would escape "DATE" datatype in CAST expression             $condnotinaction = "'" . implode("', '", $conditions['AND']['NOT']['action']) . "'";             if (!empty($conditions['org'])) {                 $condOrg = sprintf('AND org = %s', $this->getDataSource()->value($conditions['org']));             } else {                 $condOrg = '';             }

Patch:
patch: @@ -174,7 +174,7 @@ public function returnDates($org = 'all')
             // cakephp ORM would escape "DATE" datatype in CAST expression
             $condnotinaction = "'" . implode("', '", $conditions['AND']['NOT']['action']) . "'";
             if (!empty($conditions['org'])) {
-                $condOrg = ' AND org = "' . $conditions['org'] . '"';
+                $condOrg = sprintf('AND org = %s', $this->getDataSource()->value($conditions['org']));
             } else {
                 $condOrg = '';
             }
path: app/Model/Log.php