starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-22480 (published 2023-01-14T01:15Z)

KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4.\n

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/KubeOperator/KubeOperator
commit_details: repo_url: https://github.com/KubeOperator/KubeOperator
author: ssongliu
author_date: 2023-01-12 11:36:37+08:00
msg: fix: 解决K8s配置下载漏洞
repository: repo_url: https://github.com/KubeOperator/KubeOperator
repo_name: KubeOperator/KubeOperator
description: KubeOperator 是一个开源的轻量级 Kubernetes 发行版，专注于帮助企业规划、部署和运营生产级别的 K8s 集群。
repo_language: Go
owner: KubeOperator
file_changes: filename: v1api.go
change_type: ModificationType.MODIFY
diff: @@ -66,8 +66,8 @@ func V1(parent iris.Party) {
 	mvc.New(AuthScope.Party("/msg/subscribes")).HandleError(ErrorHandler).Handle(controller.NewMessageSubscribeController())
 	mvc.New(AuthScope.Party("/user/messages")).HandleError(ErrorHandler).Handle(controller.NewUserMsgController())
 	mvc.New(AuthScope.Party("/user/settings")).HandleError(ErrorHandler).Handle(controller.NewUserSettingController())
+	AuthScope.Get("/clusters/kubeconfig/{name}", downloadKubeconfig)
 	WhiteScope = v1.Party("/")
-	WhiteScope.Get("/clusters/kubeconfig/{name}", downloadKubeconfig)
 	WhiteScope.Get("/captcha", generateCaptcha)
 	mvc.New(WhiteScope.Party("/theme")).HandleError(ErrorHandler).Handle(controller.NewThemeController())
 

programming_language: Go
CVE-2024-0217 (published 2024-01-03T17:15Z)

A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.

CVSS v3 base score: 3.3, LOW (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/PackageKit/PackageKit
commit_details: repo_url: https://github.com/PackageKit/PackageKit
author: Philip Withnall
author_date: 2023-03-15 16:28:35+00:00
msg: pk-transaction: Check that Finished signal is emitted at most once

While I haven’t seen it being emitted more than once, the transaction
code is quite complex, and it would make things more robust to add a
check to verify this.

Signed-off-by: Philip Withnall <pwithnall@endlessos.org>
repository: repo_url: https://github.com/PackageKit/PackageKit
repo_name: PackageKit/PackageKit
description: A D-BUS abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API.
repo_language: C
owner: PackageKit
file_changes: filename: pk-transaction.c
change_type: ModificationType.MODIFY
diff: @@ -90,6 +90,7 @@ struct PkTransactionPrivate
 	guint			 speed;
 	guint			 download_size_remaining;
 	gboolean		 finished;
+	gboolean		 emitted_finished;
 	gboolean		 allow_cancel;
 	gboolean		 waiting_for_auth;
 	gboolean		 emit_eula_required;
@@ -510,6 +511,9 @@ pk_transaction_finished_emit (PkTransaction *transaction,
 			      PkExitEnum exit_enum,
 			      guint time_ms)
 {
+	g_assert (!transaction->priv->emitted_finished);
+	transaction->priv->emitted_finished = TRUE;
+
 	g_debug ("emitting finished '%s', %i",
 		 pk_exit_enum_to_string (exit_enum),
 		 time_ms);

programming_language: C
CVE-2022-37434 (published 2022-08-05T07:15Z)

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/madler/zlib
commit_details: repo_url: https://github.com/madler/zlib
author: Mark Adler
author_date: 2022-07-30 15:51:11-07:00
msg: Fix a bug when getting a gzip header extra field with inflate().

If the extra field was larger than the space the user provided with
inflateGetHeader(), and if multiple calls of inflate() delivered
the extra header data, then there could be a buffer overflow of the
provided space. This commit assures that provided space is not
exceeded.
repository: repo_url: https://github.com/madler/zlib
repo_name: madler/zlib
description: A massively spiffy yet delicately unobtrusive compression library.
repo_language: C
owner: madler
file_changes: filename: inflate.c
change_type: ModificationType.MODIFY
diff: @@ -763,9 +763,10 @@ int flush;
                 copy = state->length;
                 if (copy > have) copy = have;
                 if (copy) {
+                    len = state->head->extra_len - state->length;
                     if (state->head != Z_NULL &&
-                        state->head->extra != Z_NULL) {
-                        len = state->head->extra_len - state->length;
+                        state->head->extra != Z_NULL &&
+                        len < state->head->extra_max) {
                         zmemcpy(state->head->extra + len, next,
                                 len + copy > state->head->extra_max ?
                                 state->head->extra_max - len : copy);

programming_language: C
CVE-2023-46343 (published 2024-01-23T10:15Z)

In the Linux kernel before 6.5.9, there is a NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Krzysztof Kozlowski
author_date: 2023-10-13 20:41:29+02:00
msg: nfc: nci: fix possible NULL pointer dereference in send_acknowledge()

Handle memory allocation failure from nci_skb_alloc() (calling
alloc_skb()) to avoid possible NULL pointer dereference.

Reported-by: 黄思聪 <huangsicong@iie.ac.cn>
Fixes: 391d8a2da787 ("NFC: Add NCI over SPI receive")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20231013184129.18738-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: spi.c
change_type: ModificationType.MODIFY
diff: @@ -151,6 +151,8 @@ static int send_acknowledge(struct nci_spi *nspi, u8 acknowledge)
 	int ret;
 
 	skb = nci_skb_alloc(nspi->ndev, 0, GFP_KERNEL);
+	if (!skb)
+		return -ENOMEM;
 
 	/* add the NCI SPI header to the start of the buffer */
 	hdr = skb_push(skb, NCI_SPI_HDR_LEN);

programming_language: C
CVE-2024-32001 (published 2024-04-10T23:15Z)

SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: `relation folder: folder | folder#parent` with an arrow such as `folder->view` can cause LookupSubjects to only return the subjects found under subjects for either `folder` or `folder#parent`. This bug only manifests if the same subject type is used multiple types in a relation, relationships exist for both subject types and an arrow is used over the relation. Any user making a negative authorization decision based on the results of a LookupSubjects request with version before v1.30.1 is affected. Version 1.30.1 contains a patch for the issue. As a workaround, avoid using LookupSubjects for negative authorization decisions and/or avoid using the broken schema.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/authzed/spicedb
commit_details: repo_url: https://github.com/authzed/spicedb
author: Evan Cordell
author_date: 2024-04-10 17:45:21-04:00
msg: Merge pull request from GHSA-j85q-46hg-36p2

Fix SubjectSetByType to properly *merge* mapped relations
repository: repo_url: https://github.com/authzed/spicedb
repo_name: authzed/spicedb
description: Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications
repo_language: Go
owner: authzed
CVE-2020-1900 (published 2021-03-11T01:15Z)

When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. Otherwise the array might resize, invalidating previously stored references. This pre-reservation was not occurring in HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/facebook/hhvm
commit_details: repo_url: https://github.com/facebook/hhvm
author: jjergus
author_date: 2020-06-29 11:37:47-07:00
msg: CVE-2020-1900

Pre-reserve object dynamic properties when unserializing
repository: repo_url: https://github.com/facebook/hhvm
repo_name: facebook/hhvm
description: A virtual machine for executing programs written in Hack.
repo_language: Hack
owner: facebook
file_changes: filename: object-data.cpp
change_type: ModificationType.MODIFY
diff: @@ -342,6 +342,11 @@ Array& ObjectData::reserveProperties(int numDynamic /* = 2 */) {
     return dynPropArray();
   }
 
+  auto const allocsz = MixedArray::computeAllocBytesFromMaxElms(numDynamic);
+  if (UNLIKELY(allocsz > kMaxSmallSize && tl_heap->preAllocOOM(allocsz))) {
+    check_non_safepoint_surprise();
+  }
+
   return setDynPropArray(
       Array::attach(MixedArray::MakeReserveMixed(numDynamic))
   );

programming_language: C++
filename: variable-unserializer.cpp
change_type: ModificationType.MODIFY
diff: @@ -552,6 +552,7 @@ void VariableUnserializer::unserializeProp(ObjectData* obj,
     // Unserialize as a dynamic property. If this is the first, we need to
     // pre-allocate space in the array to ensure the elements don't move during
     // unserialization.
+    obj->reserveDynProps(nProp);
     t = obj->makeDynProp(realKey.get());
   } else {
     // We'll check if this doesn't violate the type-hint once we're done

programming_language: C++
CVE-2021-21311 (published 2021-02-11T21:15Z)

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-918
cwe_name: Server-Side Request Forgery (SSRF)
description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
extended_description: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
         

Fix information:
repo_url: https://github.com/vrana/adminer
commit_details: repo_url: https://github.com/vrana/adminer
author: Jakub Vrana
author_date: 2021-02-05 16:16:23+01:00
msg: Elasticsearch, ClickHouse: Do not print response if HTTP code is not 200

Thanks to Adam Crosser and Brian Sizemore
repository: repo_url: https://github.com/vrana/adminer
repo_name: vrana/adminer
description: Database management in a single PHP file
repo_language: PHP
owner: vrana
file_changes: filename: clickhouse.inc.php
change_type: ModificationType.MODIFY
diff: @@ -22,7 +22,7 @@ if (isset($_GET["clickhouse"])) {
 				return $file;
 			}
 			if (!preg_match('~^HTTP/[0-9.]+ 2~i', $http_response_header[0])) {
-				$this->error = $file;
+				$this->error = lang('Invalid credentials.') . " $http_response_header[0]";
 				return false;
 			}
 			$return = json_decode($file, true);

programming_language: PHP
filename: elastic.inc.php
change_type: ModificationType.MODIFY
diff: @@ -28,7 +28,7 @@ if (isset($_GET["elastic"])) {
 					return $file;
 				}
 				if (!preg_match('~^HTTP/[0-9.]+ 2~i', $http_response_header[0])) {
-					$this->error = $file;
+					$this->error = lang('Invalid credentials.') . " $http_response_header[0]";
 					return false;
 				}
 				$return = json_decode($file, true);

programming_language: PHP
filename: changes.txt
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,5 @@
 Adminer 4.7.9-dev:
+Elasticsearch, ClickHouse: Do not print response if HTTP code is not 200
 Re-enable PHP warnings (regression from 4.7.8)
 
 Adminer 4.7.8 (released 2020-12-06):

programming_language: Markdown
CVE-2022-1803 (published 2022-05-20T22:16Z)

Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:N/AC:M/Au:S/C:N/I:P/A:P)
CVSS v3 base score: 6.9, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:H)

Weakness information:
cwe_id: CWE-1021
cwe_name: Improper Restriction of Rendered UI Layers or Frames
description: The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
extended_description: A web application is expected to place restrictions on whether it is allowed to be rendered within frames, iframes, objects, embed or applet elements. Without the restrictions, users can be tricked into interacting with the application when they were not intending to.
         

Fix information:
repo_url: https://github.com/polonel/trudesk
commit_details: repo_url: https://github.com/polonel/trudesk
author: Chris Brame
author_date: 2022-05-18 17:38:43-04:00
msg: fix(core): iframe security fix
repository: repo_url: https://github.com/polonel/trudesk
repo_name: polonel/trudesk
description:  :coffee: :seedling: Trudesk is an open-source help desk/ticketing solution.
repo_language: JavaScript
owner: polonel
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -173,6 +173,7 @@ function allowCrossDomain (req, res, next) {
     'Access-Control-Allow-Headers',
     'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,accesstoken,X-RToken,X-Token'
   )
+  res.setHeader('Content-Security-Policy', "frame-ancestors 'none';")
 
   if (req.method === 'OPTIONS') {
     res.sendStatus(200)

programming_language: JavaScript
CVE-2021-3975 (published 2022-08-23T20:15Z)

A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/libvirt/libvirt
commit_details: repo_url: https://github.com/libvirt/libvirt
author: Peng Liang
author_date: 2021-02-24 19:28:23+08:00
msg: qemu: Add missing lock in qemuProcessHandleMonitorEOF

qemuMonitorUnregister will be called in multiple threads (e.g. threads
in rpc worker pool and the vm event thread).  In some cases, it isn't
protected by the monitor lock, which may lead to call g_source_unref
more than one time and a use-after-free problem eventually.

Add the missing lock in qemuProcessHandleMonitorEOF (which is the only
position missing lock of monitor I found).

Suggested-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Peng Liang <liangpeng10@huawei.com>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
repository: repo_url: https://github.com/libvirt/libvirt
repo_name: libvirt/libvirt
description: Read-only mirror. Please submit merge requests / issues to https://gitlab.com/libvirt/libvirt
repo_language: C
owner: libvirt
file_changes: filename: qemu_process.c
change_type: ModificationType.MODIFY
diff: @@ -318,7 +318,9 @@ qemuProcessHandleMonitorEOF(qemuMonitorPtr mon,
     /* We don't want this EOF handler to be called over and over while the
      * thread is waiting for a job.
      */
+    virObjectLock(mon);
     qemuMonitorUnregister(mon);
+    virObjectUnlock(mon);
 
     /* We don't want any cleanup from EOF handler (or any other
      * thread) to enter qemu namespace. */

programming_language: C
CVE-2024-29026 (published 2024-03-20T22:15Z)

Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit 9215d9ba0f29d62201d3feea9e77dcd274581624 fixes this issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/owncast/owncast
commit_details: repo_url: https://github.com/owncast/owncast
author: Gabe Kangas
author_date: 2023-12-18 22:05:49-08:00
msg: fix(auth): limit admin cors access to only localhost:3000
repository: repo_url: https://github.com/owncast/owncast
repo_name: owncast/owncast
description: Take control over your live stream video by running it yourself.  Streaming + chat out of the box.
repo_language: Go
owner: owncast
file_changes: filename: auth.go
change_type: ModificationType.MODIFY
diff: @@ -25,11 +25,9 @@ func RequireAdminAuth(handler http.HandlerFunc) http.HandlerFunc {
 		password := data.GetAdminPassword()
 		realm := "Owncast Authenticated Request"
 
-		// The following line is kind of a work around.
-		// If you want HTTP Basic Auth + Cors it requires _explicit_ origins to be provided in the
-		// Access-Control-Allow-Origin header.  So we just pull out the origin header and specify it.
-		// If we want to lock down admin APIs to not be CORS accessible for anywhere, this is where we would do that.
-		w.Header().Set("Access-Control-Allow-Origin", r.Header.Get("Origin"))
+		// Alow CORS only for localhost:3000 to support Owncast development.
+		validAdminHost := "http://localhost:3000"
+		w.Header().Set("Access-Control-Allow-Origin", validAdminHost)
 		w.Header().Set("Access-Control-Allow-Credentials", "true")
 		w.Header().Set("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Authorization")
 

programming_language: Go