starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-37232 (published 2021-08-04T10:15Z)

A stack overflow vulnerability occurs in Atomicparsley 20210124.204813.840499f through APar_read64() in src/util.cpp due to the lack of buffer size of uint32_buffer while reading more bytes in APar_read64.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/wez/atomicparsley
commit_details: repo_url: https://github.com/wez/atomicparsley
author: Wez Furlong
author_date: 2021-07-12 23:10:28-07:00
msg: Avoid stack overflow

refs: https://github.com/wez/atomicparsley/issues/32
repository: repo_url: https://github.com/wez/atomicparsley
repo_name: wez/atomicparsley
description: AtomicParsley is a lightweight command line program for reading, parsing and setting metadata into MPEG-4 files, in particular, iTunes-style metadata.
repo_language: C++
owner: wez
file_changes: filename: ci.yml
change_type: ModificationType.MODIFY
diff: @@ -23,3 +23,16 @@ jobs:
       run: cmake .
     - name: build
       run: cmake --build . --config Release
+
+  asan:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+    steps:
+    - uses: actions/checkout@v2
+    - name: configure
+      run: cmake -DASAN=on -DCMAKE_BUILD_TYPE=Debug .
+    - name: build
+      run: cmake --build .
+    - name: test
+      run: tests/test.sh

programming_language: Markdown
filename: extracts.cpp
change_type: ModificationType.MODIFY
diff: @@ -1588,7 +1588,7 @@ void APar_Print_TrackDetails(TrackInfo *track_info) {
 }
 
 void APar_ExtractDetails(FILE *isofile, uint8_t optional_output) {
-  char uint32_buffer[5];
+  char uint32_buffer[8];
   Trackage track = {0};
 
   AtomicInfo *mvhdAtom = APar_FindAtom("moov.mvhd", false, VERSIONED_ATOM, 0);

programming_language: C++
filename: test.sh
change_type: ModificationType.ADD
diff: @@ -0,0 +1,3 @@
+#!/bin/bash
+set -xe
+./AtomicParsley ./tests/issue-32.mp4 -T 1 -t +

programming_language: Shell
CVE-2019-18811 (published 2019-11-07T16:15Z)

A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering sof_get_ctrl_copy_params() failures, aka CID-45c1380358b1.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-10-27 16:53:24-05:00
msg: ASoC: SOF: ipc: Fix memory leak in sof_set_get_large_ctrl_data

In the implementation of sof_set_get_large_ctrl_data() there is a memory
leak in case an error. Release partdata if sof_get_ctrl_copy_params()
fails.

Fixes: 54d198d5019d ("ASoC: SOF: Propagate sof_get_ctrl_copy_params() error properly")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Link: https://lore.kernel.org/r/20191027215330.12729-1-navid.emamdoost@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: ipc.c
change_type: ModificationType.MODIFY
diff: @@ -572,8 +572,10 @@ static int sof_set_get_large_ctrl_data(struct snd_sof_dev *sdev,
 	else
 		err = sof_get_ctrl_copy_params(cdata->type, partdata, cdata,
 					       sparams);
-	if (err < 0)
+	if (err < 0) {
+		kfree(partdata);
 		return err;
+	}
 
 	msg_bytes = sparams->msg_bytes;
 	pl_size = sparams->pl_size;

programming_language: C
CVE-2024-21639 (published 2024-01-12T22:15Z)

CEF (Chromium Embedded Framework ) is a simple framework for embedding Chromium-based browsers in other applications. `CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemory` does not check the size of the shared memory, which leads to out-of-bounds read outside the sandbox. This vulnerability was patched in commit 1f55d2e.

CVSS v3 base score: 9.6, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/chromiumembedded/cef
commit_details: repo_url: https://github.com/chromiumembedded/cef
author: Marshall Greenblatt
author_date: 2024-01-05 12:14:58-05:00
msg: osr: Fix potential shared memory OOB access
repository: repo_url: https://github.com/chromiumembedded/cef
repo_name: chromiumembedded/cef
description: Chromium Embedded Framework (CEF). A simple framework for embedding Chromium-based browsers in other applications.
repo_language: C++
owner: chromiumembedded
file_changes: filename: host_display_client_osr.cc
change_type: ModificationType.MODIFY
diff: @@ -75,15 +75,24 @@ void CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemory(
     base::UnsafeSharedMemoryRegion region) {
   // Make sure |pixel_size| is sane.
   size_t expected_bytes;
-  bool size_result = viz::ResourceSizes::MaybeSizeInBytes(
-      pixel_size, viz::SinglePlaneFormat::kRGBA_8888, &expected_bytes);
-  if (!size_result) {
+  if (!viz::ResourceSizes::MaybeSizeInBytes(
+          pixel_size, viz::SinglePlaneFormat::kRGBA_8888, &expected_bytes)) {
+    DLOG(ERROR) << "OnAllocatedSharedMemory with size that overflows";
+    return;
+  }
+
+  auto mapping = region.Map();
+  if (!mapping.IsValid()) {
+    DLOG(ERROR) << "Shared memory mapping failed.";
+    return;
+  }
+  if (mapping.size() < expected_bytes) {
+    DLOG(ERROR) << "Shared memory size was less than expected.";
     return;
   }
 
   pixel_size_ = pixel_size;
-  shared_memory_ = region.Map();
-  DCHECK(shared_memory_.IsValid());
+  shared_memory_ = std::move(mapping);
 }
 
 void CefLayeredWindowUpdaterOSR::Draw(const gfx::Rect& damage_rect,

programming_language: C++
filename: video_consumer_osr.cc
change_type: ModificationType.MODIFY
diff: @@ -88,6 +88,11 @@ void CefVideoConsumerOSR::OnFrameCaptured(
         callbacks) {
   ScopedVideoFrameDone scoped_done(std::move(callbacks));
 
+  if (info->pixel_format != media::PIXEL_FORMAT_ARGB) {
+    DLOG(ERROR) << "Unsupported pixel format " << info->pixel_format;
+    return;
+  }
+
   CHECK(data->is_read_only_shmem_region());
   base::ReadOnlySharedMemoryRegion& shmem_region =
       data->get_read_only_shmem_region();

programming_language: C++
CVE-2013-7023 (published 2013-12-09T16:36Z)

The ff_combine_frame function in libavcodec/parser.c in FFmpeg before 2.1 does not properly handle certain memory-allocation errors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/FFmpeg/FFmpeg
commit_details: repo_url: https://github.com/FFmpeg/FFmpeg
author: Michael Niedermayer
author_date: 2013-09-26 21:03:48+02:00
msg: avcodec/parser: reset indexes on realloc failure

Fixes Ticket2982

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
repository: repo_url: https://github.com/FFmpeg/FFmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: FFmpeg
file_changes: filename: parser.c
change_type: ModificationType.MODIFY
diff: @@ -237,8 +237,10 @@ int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s
     if(next == END_NOT_FOUND){
         void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, (*buf_size) + pc->index + FF_INPUT_BUFFER_PADDING_SIZE);
 
-        if(!new_buffer)
+        if(!new_buffer) {
+            pc->index = 0;
             return AVERROR(ENOMEM);
+        }
         pc->buffer = new_buffer;
         memcpy(&pc->buffer[pc->index], *buf, *buf_size);
         pc->index += *buf_size;
@@ -251,9 +253,11 @@ int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s
     /* append to buffer */
     if(pc->index){
         void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, next + pc->index + FF_INPUT_BUFFER_PADDING_SIZE);
-
-        if(!new_buffer)
+        if(!new_buffer) {
+            pc->overread_index =
+            pc->index = 0;
             return AVERROR(ENOMEM);
+        }
         pc->buffer = new_buffer;
         if (next > -FF_INPUT_BUFFER_PADDING_SIZE)
             memcpy(&pc->buffer[pc->index], *buf,

programming_language: C
CVE-2021-3644 (published 2022-08-26T16:15Z)

A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.

CVSS v3 base score: 3.3, LOW (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/wildfly/wildfly-core
commit_details: repo_url: https://github.com/wildfly/wildfly-core
author: Jeff Mesnil
author_date: 2021-07-16 08:58:36+02:00
msg: Merge pull request #4668 from darranl/WFCORE-5511/main

[WFCORE-5511] wildfly-core: Invalid Sensitivity Classification of Vault Expression
repository: repo_url: https://github.com/wildfly/wildfly-core
repo_name: wildfly/wildfly-core
description: The core runtime that is used by the WildFly application server
repo_language: Java
owner: wildfly
CVE-2023-37187 (published 2023-12-25T07:15Z)

C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_decompress. function.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/Blosc/c-blosc2
commit_details: repo_url: https://github.com/Blosc/c-blosc2
author: Marta Iborra
author_date: 2023-06-21 11:16:28+02:00
msg: Fix for #519 #520 #521
repository: repo_url: https://github.com/Blosc/c-blosc2
repo_name: Blosc/c-blosc2
description: A fast, compressed, persistent binary data store library for C.
repo_language: C
owner: Blosc
file_changes: filename: blosc2-zfp.c
change_type: ModificationType.MODIFY
diff: @@ -26,6 +26,7 @@ int zfp_acc_compress(const uint8_t *input, int32_t input_len, uint8_t *output,
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(cparams);
+  ZFP_ERROR_NULL(cparams->schunk);
 
   double tol = (int8_t) meta;
   int8_t ndim;
@@ -146,6 +147,7 @@ int zfp_acc_decompress(const uint8_t *input, int32_t input_len, uint8_t *output,
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(dparams);
+  ZFP_ERROR_NULL(dparams->schunk);
   BLOSC_UNUSED_PARAM(chunk);
 
   blosc2_schunk *sc = dparams->schunk;
@@ -241,6 +243,7 @@ int zfp_prec_compress(const uint8_t *input, int32_t input_len, uint8_t *output,
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(cparams);
+  ZFP_ERROR_NULL(cparams->schunk);
 
   int8_t ndim;
   int64_t *shape = malloc(8 * sizeof(int64_t));
@@ -385,6 +388,7 @@ int zfp_prec_decompress(const uint8_t *input, int32_t input_len, uint8_t *output
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(dparams);
+  ZFP_ERROR_NULL(dparams->schunk);
   BLOSC_UNUSED_PARAM(chunk);
 
   blosc2_schunk *sc = dparams->schunk;
@@ -504,6 +508,7 @@ int zfp_rate_compress(const uint8_t *input, int32_t input_len, uint8_t *output,
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(cparams);
+  ZFP_ERROR_NULL(cparams->schunk);
 
   double ratio = (double) meta / 100.0;
   int8_t ndim;
@@ -635,6 +640,7 @@ int zfp_rate_decompress(const uint8_t *input, int32_t input_len, uint8_t *output
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(dparams);
+  ZFP_ERROR_NULL(dparams->schunk);
   BLOSC_UNUSED_PARAM(chunk);
 
   blosc2_schunk *sc = dparams->schunk;

programming_language: C
CVE-2024-41132 (published 2024-07-22T15:15Z)

ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. All users are advised to upgrade to v3.1.5 or v2.1.9.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/SixLabors/ImageSharp
commit_details: repo_url: https://github.com/SixLabors/ImageSharp
author: James Jackson-South
author_date: 2024-07-07 16:40:08+10:00
msg: Merge pull request #2764 from SixLabors/js/v4-merge-2758-fix

v4 Fix 2758
repository: repo_url: https://github.com/SixLabors/ImageSharp
repo_name: SixLabors/ImageSharp
description: :camera: A modern, cross-platform, 2D Graphics library for .NET
repo_language: C#
owner: SixLabors
repo_url: https://github.com/SixLabors/ImageSharp
commit_details: repo_url: https://github.com/SixLabors/ImageSharp
author: James Jackson-South
author_date: 2024-07-07 16:09:22+10:00
msg: Merge pull request #2759 from SixLabors/js/fix-2758

v3.1.x Fix 2758
repository: repo_url: https://github.com/SixLabors/ImageSharp
repo_name: SixLabors/ImageSharp
description: :camera: A modern, cross-platform, 2D Graphics library for .NET
repo_language: C#
owner: SixLabors
CVE-2023-3696 (published 2023-07-17T01:15Z)

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/automattic/mongoose
commit_details: repo_url: https://github.com/automattic/mongoose
author: Valeri Karpov
author_date: 2023-07-08 20:10:42-04:00
msg: fix: avoid prototype pollution on init
repository: repo_url: https://github.com/automattic/mongoose
repo_name: Automattic/mongoose
description: MongoDB object modeling designed to work in an asynchronous environment.
repo_language: JavaScript
owner: automattic
file_changes: filename: document.js
change_type: ModificationType.MODIFY
diff: @@ -740,6 +740,10 @@ function init(self, obj, doc, opts, prefix) {
 
   function _init(index) {
     i = keys[index];
+    // avoid prototype pollution
+    if (i === '__proto__' || i === 'constructor') {
+      return;
+    }
     path = prefix + i;
     schemaType = docSchema.path(path);
 

programming_language: JavaScript
filename: document.test.js
change_type: ModificationType.MODIFY
diff: @@ -12278,6 +12278,24 @@ describe('document', function() {
     assert.equal(fromDb.obj.subArr.length, 1);
     assert.equal(fromDb.obj.subArr[0].str, 'subArr.test1');
   });
+
+  it('avoids prototype pollution on init', async function() {
+    const Example = db.model('Example', new Schema({ hello: String }));
+
+    const example = await new Example({ hello: 'world!' }).save();
+    await Example.findByIdAndUpdate(example._id, {
+      $rename: {
+        hello: '__proto__.polluted'
+      }
+    });
+
+    // this is what causes the pollution
+    await Example.find();
+
+    const test = {};
+    assert.strictEqual(test.polluted, undefined);
+    assert.strictEqual(Object.prototype.polluted, undefined);
+  });
 });
 
 describe('Check if instance function that is supplied in schema option is availabe', function() {

programming_language: JavaScript
CVE-2020-12279 (published 2020-04-27T17:15Z)

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-706
cwe_name: Use of Incorrectly-Resolved Name or Reference
description: The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/libgit2/libgit2
commit_details: repo_url: https://github.com/libgit2/libgit2
author: Johannes Schindelin
author_date: 2019-09-18 15:25:02+02:00
msg: Protect against 8.3 "short name" attacks also on Linux/macOS

The Windows Subsystem for Linux (WSL) is getting increasingly popular,
in particular because it makes it _so_ easy to run Linux software on
Windows' files, via the auto-mounted Windows drives (`C:\` is mapped to
`/mnt/c/`, no need to set that up manually).

Unfortunately, files/directories on the Windows drives can be accessed
via their _short names_, if that feature is enabled (which it is on the
`C:` drive by default).

Which means that we have to safeguard even our Linux users against the
short name attacks.

Further, while the default options of CIFS/SMB-mounts seem to disallow
accessing files on network shares via their short names on Linux/macOS,
it _is_ possible to do so with the right options.

So let's just safe-guard against short name attacks _everywhere_.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
repository: repo_url: https://github.com/libgit2/libgit2
repo_name: libgit2/libgit2
description: A cross-platform, linkable library implementation of Git that you can use in your application.
repo_language: C
owner: libgit2
file_changes: filename: checkout.c
change_type: ModificationType.MODIFY
diff: @@ -1271,7 +1271,7 @@ static int checkout_verify_paths(
 	int action,
 	git_diff_delta *delta)
 {
-	unsigned int flags = GIT_PATH_REJECT_WORKDIR_DEFAULTS;
+	unsigned int flags = GIT_PATH_REJECT_WORKDIR_DEFAULTS | GIT_PATH_REJECT_DOT_GIT_NTFS;
 
 	if (action & CHECKOUT_ACTION__REMOVE) {
 		if (!git_path_isvalid(repo, delta->old_file.path, delta->old_file.mode, flags)) {

programming_language: C
filename: nasty.c
change_type: ModificationType.MODIFY
diff: @@ -206,9 +206,8 @@ void test_checkout_nasty__dot_git_dot(void)
  */
 void test_checkout_nasty__git_tilde1(void)
 {
-#ifdef GIT_WIN32
 	test_checkout_fails("refs/heads/git_tilde1", ".git/foobar");
-#endif
+	test_checkout_fails("refs/heads/git_tilde1", "git~1/foobar");
 }
 
 /* A tree that contains an entry "git~2", when we have forced the short

programming_language: C
CVE-2024-34069 (published 2024-05-06T15:15Z)

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/pallets/werkzeug
commit_details: repo_url: https://github.com/pallets/werkzeug
author: David Lord
author_date: 2024-05-05 16:00:13-07:00
msg: Merge pull request from GHSA-2g68-c3qc-8985

restrict debugger trusted hosts
repository: repo_url: https://github.com/pallets/werkzeug
repo_name: pallets/werkzeug
description: The comprehensive WSGI web application library.
repo_language: Python
owner: pallets