starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-2800 (published 2023-05-18T17:15Z)

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.

CVSS v3 base score: 4.7, MEDIUM (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-377
cwe_name: Insecure Temporary File
description: Creating and using insecure temporary files can leave application and system data vulnerable to attack.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/huggingface/transformers
commit_details: repo_url: https://github.com/huggingface/transformers
author: ready-research
author_date: 2023-05-16 15:40:54+05:30
msg: Use `mkstemp` to replace deprecated `mktemp` (#23372)

* Use `mkstemp` to replace deprecated `mktemp`

The `tempfile.mktemp` function is [deprecated](https://docs.python.org/3/library/tempfile.html#tempfile.mktemp) due to [security issues](https://cwe.mitre.org/data/definitions/377.html).

* Update src/transformers/utils/hub.py

Co-authored-by: amyeroberts <22614925+amyeroberts@users.noreply.github.com>

---------

Co-authored-by: amyeroberts <22614925+amyeroberts@users.noreply.github.com>
repository: repo_url: https://github.com/huggingface/transformers
repo_name: huggingface/transformers
description: 🤗 Transformers: State-of-the-art Machine Learning for Pytorch, TensorFlow, and JAX.
repo_language: Python
owner: huggingface
file_changes: filename: hub.py
change_type: ModificationType.MODIFY
diff: @@ -578,7 +578,7 @@ def download_url(url, proxies=None):
         " that this is not compatible with the caching system (your file will be downloaded at each execution) or"
         " multiple processes (each process will download the file in a different temporary file)."
     )
-    tmp_file = tempfile.mktemp()
+    tmp_file = tempfile.mkstemp()[1]
     with open(tmp_file, "wb") as f:
         http_get(url, f, proxies=proxies)
     return tmp_file

programming_language: Python
CVE-2022-29161 (published 2022-05-06T00:15Z)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collisions with SHA1. The problem has been patched in XWiki version 13.10.6, 14.3.1 and 14.4-rc-1. Since then, the Crypto API will generate X509 certificates signed by default using SHA256 with RSA. Administrators are advised to upgrade their XWiki installation to one of the patched versions. If the upgrade is not possible, it is possible to patch the module xwiki-platform-crypto in a local installation by applying the change exposed in 26728f3 and re-compiling the module.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-326
cwe_name: Inadequate Encryption Strength
description: The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
extended_description: A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.
         

Fix information:
repo_url: https://github.com/xwiki/xwiki-platform
commit_details: repo_url: https://github.com/xwiki/xwiki-platform
author: Clément Aubin
author_date: 2022-04-30 12:13:25+02:00
msg: XWIKI-19676: Update the RSA Crypto script service to use SHA256 instead of SHA1 for certificate signature
repository: repo_url: https://github.com/xwiki/xwiki-platform
repo_name: xwiki/xwiki-platform
description: The XWiki platform
repo_language: Java
owner: xwiki
file_changes: filename: RSACryptoScriptService.java
change_type: ModificationType.MODIFY
diff: @@ -86,7 +86,7 @@ public class RSACryptoScriptService implements ScriptService
     private KeyPairGenerator keyPairGenerator;
 
     @Inject
-    @Named("SHA1withRSAEncryption")
+    @Named("SHA256withRSAEncryption")
     private SignerFactory signerFactory;
 
     @Inject

programming_language: Java
CVE-2021-3757 (published 2021-09-02T12:15Z)

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/immerjs/immer
commit_details: repo_url: https://github.com/immerjs/immer
author: Michel Weststrate
author_date: 2021-08-31 19:59:35+01:00
msg: fix(security): Follow up on CVE-2020-28477 where `path: [["__proto__"], "x"]` could still pollute the prototype
repository: repo_url: https://github.com/immerjs/immer
repo_name: immerjs/immer
description: Create the next immutable state by mutating the current one
repo_language: JavaScript
owner: immerjs
file_changes: filename: patch.js
change_type: ModificationType.MODIFY
diff: @@ -1258,6 +1258,24 @@ test("maps can store __proto__, prototype and constructor props", () => {
 	expect(obj.polluted).toBe(undefined)
 })
 
+test("CVE-2020-28477 (https://snyk.io/vuln/SNYK-JS-IMMER-1019369) follow up", () => {
+	const obj = {}
+
+	// @ts-ignore
+	expect(obj.polluted).toBe(undefined)
+	expect(() => {
+		applyPatches({}, [
+			{op: "add", path: [["__proto__"], "polluted"], value: "yes"}
+		])
+	}).toThrow(
+		isProd
+			? "24"
+			: "Patching reserved attributes like __proto__, prototype and constructor is not allowed"
+	)
+	// @ts-ignore
+	expect(obj.polluted).toBe(undefined)
+})
+
 test("#648 assigning object to itself should not change patches", () => {
 	const input = {
 		obj: {

programming_language: Swift
filename: patches.ts
change_type: ModificationType.MODIFY
diff: @@ -207,7 +207,7 @@ export function enablePatches() {
 			let base: any = draft
 			for (let i = 0; i < path.length - 1; i++) {
 				const parentType = getArchtype(base)
-				const p = path[i]
+				const p = "" + path[i]
 				// See #738, avoid prototype pollution
 				if (
 					(parentType === Archtype.Object || parentType === Archtype.Array) &&

programming_language: Go
CVE-2019-20421 (published 2020-01-27T05:15Z)

In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/Exiv2/exiv2
commit_details: repo_url: https://github.com/Exiv2/exiv2
author: D4N
author_date: 2019-10-05 09:58:31+02:00
msg: Fix #1011 fix_1011_jp2_readmetadata_loop (#1013)

Fix #1011 fix_1011_jp2_readmetadata_loop
repository: repo_url: https://github.com/Exiv2/exiv2
repo_name: Exiv2/exiv2
description: Image metadata library and tools
repo_language: C++
owner: Exiv2
CVE-2020-36048 (published 2021-01-08T00:15Z)

Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-400
cwe_name: Uncontrolled Resource Consumption
description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
extended_description: 
            Limited resources include memory, file system storage, database connection pool entries, and CPU. If an attacker can trigger the allocation of these limited resources, but the number or size of the resources is not controlled, then the attacker could cause a denial of service that consumes all available resources. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding environment. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system.
            There are at least three distinct scenarios which can commonly lead to resource exhaustion:
               
                  Lack of throttling for the number of allocated resources
                  Losing all references to a resource before reaching the shutdown stage
                  Not closing/returning a resource after processing
               
            Resource exhaustion problems are often result due to an incorrect implementation of the following situations:
               
                  Error conditions and other exceptional circumstances.
                  Confusion over which part of the program is responsible for releasing the resource.
               
         
         

Fix information:
repo_url: https://github.com/socketio/engine.io
commit_details: repo_url: https://github.com/socketio/engine.io
author: Damien Arrachequesne
author_date: 2020-02-11 07:57:29+01:00
msg: feat: decrease the default value of maxHttpBufferSize

This change reduces the default value from 100 mb to a more sane 1 mb.

This helps protect the server against denial of service attacks by
malicious clients sending huge amounts of data.
repository: repo_url: https://github.com/socketio/engine.io
repo_name: socketio/engine.io
description: The engine used in the Socket.IO JavaScript server, which manages the low-level transports such as HTTP long-polling and WebSocket. 
owner: socketio
file_changes: filename: server.js
change_type: ModificationType.MODIFY
diff: @@ -26,7 +26,7 @@ class Server extends EventEmitter {
         pingTimeout: 5000,
         pingInterval: 25000,
         upgradeTimeout: 10000,
-        maxHttpBufferSize: 10e7,
+        maxHttpBufferSize: 1e6,
         transports: Object.keys(transports),
         allowUpgrades: true,
         perMessageDeflate: {

programming_language: TypeScript
CVE-2021-38597 (published 2021-08-12T15:15Z)

wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck extension.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.9, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-345
cwe_name: Insufficient Verification of Data Authenticity
description: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/wolfSSL/wolfssl
commit_details: repo_url: https://github.com/wolfSSL/wolfssl
author: Sean Parkinson
author_date: 2021-07-16 12:19:39+10:00
msg: OCSP: improve handling of OCSP no check extension
repository: repo_url: https://github.com/wolfSSL/wolfssl
repo_name: wolfSSL/wolfssl
description: The wolfSSL library is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud.  wolfSSL supports up to TLS 1.3 and DTLS 1.3!
repo_language: C
owner: wolfSSL
file_changes: filename: asn.c
change_type: ModificationType.MODIFY
diff: @@ -10212,9 +10212,13 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm)
             }
 
         #ifdef HAVE_OCSP
-            /* trust for the lifetime of the responder's cert*/
-            if (cert->ocspNoCheckSet && verify == VERIFY_OCSP)
-                verify = NO_VERIFY;
+            if (verify == VERIFY_OCSP_CERT) {
+                /* trust for the lifetime of the responder's cert*/
+                if (cert->ocspNoCheckSet)
+                    verify = VERIFY;
+                else
+                    verify = VERIFY_OCSP;
+            }
         #endif
             /* advance past extensions */
             cert->srcIdx = cert->sigIndex;
@@ -17957,7 +17961,7 @@ static int DecodeBasicOcspResponse(byte* source, word32* ioIndex,
 
         /* Don't verify if we don't have access to Cert Manager. */
         ret = ParseCertRelative(&cert, CERT_TYPE,
-                                noVerify ? NO_VERIFY : VERIFY_OCSP, cm);
+                                noVerify ? NO_VERIFY : VERIFY_OCSP_CERT, cm);
         if (ret < 0) {
             WOLFSSL_MSG("\tOCSP Responder certificate parsing failed");
             FreeDecodedCert(&cert);

programming_language: C
filename: asn.h
change_type: ModificationType.MODIFY
diff: @@ -599,6 +599,7 @@ enum VerifyType {
     VERIFY_OCSP = 3,
     VERIFY_NAME = 4,
     VERIFY_SKIP_DATE = 5,
+    VERIFY_OCSP_CERT = 6,
 };
 
 #ifdef WOLFSSL_CERT_EXT

programming_language: C
CVE-2014-1604 (published 2014-01-28T00:55Z)

The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/alex/rply
commit_details: repo_url: https://github.com/alex/rply
author: Alex Gaynor
author_date: 2014-01-17 17:16:39-06:00
msg: The parser cache is now always handled in a per-user fashion.

This avoids issues with people providing malciious caches in a multi-user
system.

Originally reported as: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=735263

A CVE number has been requested
repository: repo_url: https://github.com/alex/rply
repo_name: alex/rply
description: An attempt to port David Beazley's PLY to RPython, and give it a cooler API.
repo_language: Python
owner: alex
file_changes: filename: parsergenerator.py
change_type: ModificationType.MODIFY
diff: @@ -2,6 +2,7 @@ import os
 import hashlib
 import json
 import random
+import stat
 import string
 import sys
 import tempfile
@@ -124,17 +125,23 @@ class ParserGenerator(object):
 
         cache_file = os.path.join(
             tempfile.gettempdir(),
-            "rply-%s-%s-%s.json" % (self.VERSION, self.cache_id, self.compute_grammar_hash(g))
+            "rply-%s-%s-%s-%s.json" % (self.VERSION, os.getuid(), self.cache_id, self.compute_grammar_hash(g))
         )
         table = None
         if os.path.exists(cache_file):
             with open(cache_file) as f:
                 data = json.load(f)
-            if self.data_is_valid(g, data):
-                table = LRTable.from_cache(g, data)
+                stat_result = os.fstat(f.fileno())
+            if (
+                stat_result.st_uid == os.getuid() and
+                stat.S_IMODE(stat_result.st_mode) == 0o0600
+            ):
+                if self.data_is_valid(g, data):
+                    table = LRTable.from_cache(g, data)
         if table is None:
             table = LRTable.from_grammar(g)
-            with open(cache_file, "w") as f:
+            fd = os.open(cache_file, os.O_RDWR | os.O_CREAT | os.O_EXCL, 0o0600)
+            with os.fdopen(fd, "w") as f:
                 json.dump(self.serialize_table(table), f)
         if table.sr_conflicts:
             warnings.warn(

programming_language: Python
CVE-2016-10524 (published 2018-05-31T20:29Z)

i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in i18n-node-angular before 1.4.0 was not disabled in production environments a malicious user could fill up the server causing a Denial of Service or content injection.

Severity: MEDIUM
CVSS v2 base score: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H)

Weakness information:
cwe_id: CWE-400
cwe_name: Uncontrolled Resource Consumption
description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
extended_description: 
            Limited resources include memory, file system storage, database connection pool entries, and CPU. If an attacker can trigger the allocation of these limited resources, but the number or size of the resources is not controlled, then the attacker could cause a denial of service that consumes all available resources. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding environment. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system.
            There are at least three distinct scenarios which can commonly lead to resource exhaustion:
               
                  Lack of throttling for the number of allocated resources
                  Losing all references to a resource before reaching the shutdown stage
                  Not closing/returning a resource after processing
               
            Resource exhaustion problems are often result due to an incorrect implementation of the following situations:
               
                  Error conditions and other exceptional circumstances.
                  Confusion over which part of the program is responsible for releasing the resource.
               
         
         

Fix information:
repo_url: https://github.com/oliversalzburg/i18n-node-angular
commit_details: repo_url: https://github.com/oliversalzburg/i18n-node-angular
author: Oliver Salzburg
author_date: 2016-01-07 09:40:02+01:00
msg: [FIX] Only register translate route during development
repository: repo_url: https://github.com/oliversalzburg/i18n-node-angular
repo_name: oliversalzburg/i18n-node-angular
description: An approach to utilize i18n-node in an AngularJS application
repo_language: JavaScript
owner: oliversalzburg
file_changes: filename: i18n-node-routes.js
change_type: ModificationType.MODIFY
diff: @@ -49,7 +49,10 @@ var configure = function( app, configObject ) {
 
 	// Register routes
 	app.get( "/i18n/:locale", i18nRoutes.i18n );
-	app.get( "/i18n/:locale/:phrase", i18nRoutes.translate );
+
+	if( process.env.NODE_ENV === "development" ) {
+		app.get( "/i18n/:locale/:phrase", i18nRoutes.translate );
+	}
 };
 
 /**

programming_language: JavaScript
CVE-2014-2528 (published 2014-08-26T14:55Z)

kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://bitbucket.org/jeromerobert/k4dirstat
commit_details: repo_url: https://bitbucket.org/jeromerobert/k4dirstat
author: Jerome Robert
author_date: 2014-03-15 16:54:34+01:00
msg: Properly escape %p and %n in cleaning actions
repository: repo_url: https://bitbucket.org/jeromerobert/k4dirstat
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: jeromerobert
file_changes: filename: kcleanup.cpp
change_type: ModificationType.MODIFY
diff: @@ -318,11 +318,10 @@ KCleanup::expandVariables( const KFileInfo *	item,
 			   const QString &	unexpanded ) const
 {
     QString expanded = unexpanded;
-
-    expanded.replace( QRegExp( "%p" ),
-		      "'" + QString::fromLocal8Bit( item->url() )  + "'" );
-    expanded.replace( QRegExp( "%n" ),
-		      "'" + QString::fromLocal8Bit( item->name() ) + "'" );
+    QString url = QString::fromLocal8Bit( item->url() ).replace("'", "'\\''");
+    expanded.replace( QRegExp( "%p" ), "'" + url + "'" );
+    QString name = QString::fromLocal8Bit( item->name() ).replace("'", "'\\''");
+    expanded.replace( QRegExp( "%n" ), "'" + name + "'" );
 
    // if ( KDE::versionMajor() >= 3 && KDE::versionMinor() >= 4 )
 	expanded.replace( QRegExp( "%t" ), "trash:/" );

programming_language: C++