starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2019-18848 (published 2019-11-12T15:15Z)

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/nov/json-jwt
commit_details: repo_url: https://github.com/nov/json-jwt
author: nov
author_date: 2019-11-11 23:28:48+09:00
msg: explicitly specifying number of elements when splitting JWE string

ref.) CVE-2019-18848
repository: repo_url: https://github.com/nov/json-jwt
repo_name: nov/json-jwt
description: JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON Web Key) in Ruby
repo_language: Ruby
owner: nov
file_changes: filename: jwe.rb
change_type: ModificationType.MODIFY
diff: @@ -254,7 +254,7 @@ module JSON
           raise InvalidFormat.new("Invalid JWE Format. JWE should include #{NUM_OF_SEGMENTS} segments.")
         end
         jwe = new
-        _header_json_, jwe.jwe_encrypted_key, jwe.iv, jwe.cipher_text, jwe.authentication_tag = input.split('.').collect do |segment|
+        _header_json_, jwe.jwe_encrypted_key, jwe.iv, jwe.cipher_text, jwe.authentication_tag = input.split('.', NUM_OF_SEGMENTS).collect do |segment|
           begin
             Base64.urlsafe_decode64 segment
           rescue ArgumentError

programming_language: Ruby
filename: jws.rb
change_type: ModificationType.MODIFY
diff: @@ -179,7 +179,7 @@ module JSON
         unless input.count('.') + 1 == NUM_OF_SEGMENTS
           raise InvalidFormat.new("Invalid JWS Format. JWS should include #{NUM_OF_SEGMENTS} segments.")
         end
-        header, claims, signature = input.split('.', JWS::NUM_OF_SEGMENTS).collect do |segment|
+        header, claims, signature = input.split('.', NUM_OF_SEGMENTS).collect do |segment|
           Base64.urlsafe_decode64 segment.to_s
         end
         header = JSON.parse(header).with_indifferent_access
@@ -191,7 +191,7 @@ module JSON
         jws = new claims
         jws.header = header
         jws.signature = signature
-        jws.signature_base_string = input.split('.')[0, JWS::NUM_OF_SEGMENTS - 1].join('.')
+        jws.signature_base_string = input.split('.')[0, NUM_OF_SEGMENTS - 1].join('.')
         jws.verify! public_key_or_secret, algorithms unless public_key_or_secret == :skip_verification
         jws
       end

programming_language: Ruby
CVE-2024-26140 (published 2024-02-20T22:15Z)

com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/yetanalytics/lrs
commit_details: repo_url: https://github.com/yetanalytics/lrs
author: Cliff Casey
author_date: 2024-02-16 15:26:48-05:00
msg: Merge pull request #89 from yetanalytics/sanitize_value_outputs

sanitize possible html value injections in all value renders
repository: repo_url: https://github.com/yetanalytics/lrs
repo_name: yetanalytics/lrs
description: Protocols, specifications, and logic for building an xAPI Learning Record Store (LRS) in Clojure(Script).
repo_language: Clojure
owner: yetanalytics
CVE-2020-21674 (published 2020-10-15T15:15Z)

Heap-based buffer overflow in archive_string_append_from_wcs() (archive_string.c) in libarchive-3.4.1dev allows remote attackers to cause a denial of service (out-of-bounds write in heap memory resulting into a crash) via a crafted archive file. NOTE: this only affects users who downloaded the development code from GitHub. Users of the product's official releases are unaffected.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/libarchive/libarchive
commit_details: repo_url: https://github.com/libarchive/libarchive
author: Martin Matuska
author_date: 2019-12-28 22:58:08+01:00
msg: Fix a possible heap-buffer-overflow in archive_string_append_from_wcs()

When we grow the archive_string buffer, we have to make sure it fits
at least one maximum-sized multibyte character in the current locale
and the null character.

Fixes #1298
repository: repo_url: https://github.com/libarchive/libarchive
repo_name: libarchive/libarchive
description: Multi-format archive and compression library
repo_language: C
owner: libarchive
file_changes: filename: archive_string.c
change_type: ModificationType.MODIFY
diff: @@ -75,6 +75,9 @@ __FBSDID("$FreeBSD: head/lib/libarchive/archive_string.c 201095 2009-12-28 02:33
 #define wmemmove(a,b,i)  (wchar_t *)memmove((a), (b), (i) * sizeof(wchar_t))
 #endif
 
+#undef max
+#define max(a, b)       ((a)>(b)?(a):(b))
+
 struct archive_string_conv {
 	struct archive_string_conv	*next;
 	char				*from_charset;
@@ -804,7 +807,8 @@ archive_string_append_from_wcs(struct archive_string *as,
 			as->s[as->length] = '\0';
 			/* Re-allocate buffer for MBS. */
 			if (archive_string_ensure(as,
-			    as->length + len * 2 + 1) == NULL)
+			    as->length + max(len * 2,
+			    (size_t)MB_CUR_MAX) + 1) == NULL)
 				return (-1);
 			p = as->s + as->length;
 			end = as->s + as->buffer_length - MB_CUR_MAX -1;
@@ -3446,7 +3450,8 @@ strncat_from_utf8_libarchive2(struct archive_string *as,
 			as->length = p - as->s;
 			/* Re-allocate buffer for MBS. */
 			if (archive_string_ensure(as,
-			    as->length + len * 2 + 1) == NULL)
+			    as->length + max(len * 2,
+			    (size_t)MB_CUR_MAX) + 1) == NULL)
 				return (-1);
 			p = as->s + as->length;
 			end = as->s + as->buffer_length - MB_CUR_MAX -1;

programming_language: C
CVE-2022-2564 (published 2022-07-28T20:15Z)

Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/automattic/mongoose
commit_details: repo_url: https://github.com/automattic/mongoose
author: Valeri Karpov
author_date: 2022-07-18 22:21:57-04:00
msg: fix(schema): disallow setting __proto__ when creating schema with dotted properties

Fix #12085
repository: repo_url: https://github.com/automattic/mongoose
repo_name: Automattic/mongoose
description: MongoDB object modeling designed to work in an asynchronous environment.
repo_language: JavaScript
owner: automattic
file_changes: filename: schema.js
change_type: ModificationType.MODIFY
diff: @@ -554,6 +554,10 @@ Schema.prototype.add = function add(obj, prefix) {
   const keys = Object.keys(obj);
   const typeKey = this.options.typeKey;
   for (const key of keys) {
+    if (utils.specialProperties.has(key)) {
+      continue;
+    }
+
     const fullPath = prefix + key;
     const val = obj[key];
 
@@ -854,6 +858,9 @@ Schema.prototype.path = function(path, obj) {
   let fullPath = '';
 
   for (const sub of subpaths) {
+    if (utils.specialProperties.has(sub)) {
+      throw new Error('Cannot set special property `' + sub + '` on a schema');
+    }
     fullPath = fullPath += (fullPath.length > 0 ? '.' : '') + sub;
     if (!branch[sub]) {
       this.nested[fullPath] = true;

programming_language: JavaScript
filename: schema.test.js
change_type: ModificationType.MODIFY
diff: @@ -2792,4 +2792,14 @@ describe('schema', function() {
       });
     }, /Cannot use schema-level projections.*subdocument_mapping.not_selected/);
   });
+
+  it('disallows setting special properties with `add()` or constructor (gh-12085)', async function() {
+    const maliciousPayload = '{"__proto__.toString": "Number"}';
+
+    assert.throws(() => {
+      mongoose.Schema(JSON.parse(maliciousPayload));
+    }, /__proto__/);
+
+    assert.ok({}.toString());
+  });
 });

programming_language: JavaScript
CVE-2018-15822 (published 2018-08-23T23:29Z)

The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-617
cwe_name: Reachable Assertion
description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
extended_description: 
            While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service.
            For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.
         
         

Fix information:
repo_url: https://github.com/FFmpeg/FFmpeg
commit_details: repo_url: https://github.com/FFmpeg/FFmpeg
author: Michael Niedermayer
author_date: 2018-07-28 15:03:50+02:00
msg: avformat/flvenc: Check audio packet size

Fixes: Assertion failure
Fixes: assert_flvenc.c:941_1.swf

Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
repository: repo_url: https://github.com/FFmpeg/FFmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: FFmpeg
file_changes: filename: flvenc.c
change_type: ModificationType.MODIFY
diff: @@ -883,6 +883,11 @@ static int flv_write_packet(AVFormatContext *s, AVPacket *pkt)
     int flags = -1, flags_size, ret;
     int64_t cur_offset = avio_tell(pb);
 
+    if (par->codec_type == AVMEDIA_TYPE_AUDIO && !pkt->size) {
+        av_log(s, AV_LOG_WARNING, "Empty audio Packet\n");
+        return AVERROR(EINVAL);
+    }
+
     if (par->codec_id == AV_CODEC_ID_VP6F || par->codec_id == AV_CODEC_ID_VP6A ||
         par->codec_id == AV_CODEC_ID_VP6  || par->codec_id == AV_CODEC_ID_AAC)
         flags_size = 2;

programming_language: C
CVE-2022-24774 (published 2022-03-22T17:15Z)

CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability to create arbitrary directories or a denial of service by deleting arbitrary directories. The vulnerability is resolved in version 2.0.1. The vulnerability is not exploitable with the default configuration with the post and delete methods disabled. This can be configured by modifying the `appsettings.json` file, or alternatively, setting the environment variables `ALLOWEDMETHODS__POST` and `ALLOWEDMETHODS__DELETE` to `false`.

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:N/I:P/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/CycloneDX/cyclonedx-bom-repo-server
commit_details: repo_url: https://github.com/CycloneDX/cyclonedx-bom-repo-server
author: Patrick Dwyer
author_date: 2022-03-22 00:37:25+00:00
msg: Security release - remediation of CVE-2022-24774

Signed-off-by: Patrick Dwyer <patrick.dwyer@owasp.org>
repository: repo_url: https://github.com/CycloneDX/cyclonedx-bom-repo-server
repo_name: CycloneDX/cyclonedx-bom-repo-server
description: A BOM repository server for distributing CycloneDX BOMs
repo_language: C#
owner: CycloneDX
file_changes: filename: semver.txt
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-2.0.0
+2.0.1

programming_language: SQL
CVE-2020-7795 (published 2022-08-02T14:15Z)

The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/hoperyy/get-npm-package-version
commit_details: repo_url: https://github.com/hoperyy/get-npm-package-version
author: DuLinRain
author_date: 2021-01-26 11:48:05+08:00
msg: feat: add defence to Command Injection

add defence to Command Injection
repository: repo_url: https://github.com/hoperyy/get-npm-package-version
repo_name: hoperyy/get-npm-package-version
description: get npm package version
repo_language: JavaScript
owner: hoperyy
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,8 @@
 module.exports = function (packageName, { registry = '', timeout = null } = {}) {
     try {
+        if (/[`$&{}[;|]/g.test(packageName) || /[`$&{}[;|]/g.test(registry)) {
+            return null
+        }
         let version;
 
         const config = {

programming_language: JavaScript
CVE-2019-14806 (published 2019-08-09T15:15Z)

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-331
cwe_name: Insufficient Entropy
description: The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/pallets/werkzeug
commit_details: repo_url: https://github.com/pallets/werkzeug
author: David Lord
author_date: 2019-05-14 13:43:22-07:00
msg: unique debugger pin in Docker containers
repository: repo_url: https://github.com/pallets/werkzeug
repo_name: pallets/werkzeug
description: The comprehensive WSGI web application library.
repo_language: Python
owner: pallets
file_changes: filename: CHANGES.rst
change_type: ModificationType.MODIFY
diff: @@ -20,6 +20,8 @@ Unreleased
     (:issue:`1510`)
 -   The debugger detects cycles in chained exceptions and does not time
     out in that case. (:issue:`1536`)
+-   When running the development server in Docker, the debugger security
+    pin is now unique per container.
 
 
 Version 0.15.2

programming_language: Markdown
filename: __init__.py
change_type: ModificationType.MODIFY
diff: @@ -67,6 +67,19 @@ def get_machine_id():
         return rv
 
     def _generate():
+        # docker containers share the same machine id, get the
+        # container id instead
+        try:
+            with open("/proc/self/cgroup") as f:
+                value = f.readline()
+        except IOError:
+            pass
+        else:
+            value = value.strip().partition("/docker/")[2]
+
+            if value:
+                return value
+
         # Potential sources of secret information on linux.  The machine-id
         # is stable across boots, the boot id is not
         for filename in "/etc/machine-id", "/proc/sys/kernel/random/boot_id":

programming_language: Python
CVE-2023-23621 (published 2023-01-28T00:15Z)

Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches, a malicious user can cause a regular expression denial of service using a carefully crafted user agent. This issue is patched in version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches. There are no known workarounds.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/discourse/discourse
commit_details: repo_url: https://github.com/discourse/discourse
author: Bianca Nenciu
author_date: 2023-01-25 18:55:33+02:00
msg: SECURITY: Prevent ReDoS in user agent parsing (#20002)

Co-authored-by: Penar Musaraj <pmusaraj@gmail.com>
repository: repo_url: https://github.com/discourse/discourse
repo_name: discourse/discourse
description: A platform for community discussion. Free, open, simple.
repo_language: Ruby
owner: discourse
file_changes: filename: mobile_detection.rb
change_type: ModificationType.MODIFY
diff: @@ -36,7 +36,9 @@ module MobileDetection
     Firefox\/1[0-9][0-9]
   }x
 
+  USER_AGENT_MAX_LENGTH = 400
+
   def self.modern_mobile_device?(user_agent)
-    user_agent.match?(MODERN_MOBILE_REGEX)
+    user_agent[0...USER_AGENT_MAX_LENGTH].match?(MODERN_MOBILE_REGEX)
   end
 end

programming_language: Ruby
CVE-2023-24623 (published 2023-01-30T05:15Z)

Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-918
cwe_name: Server-Side Request Forgery (SSRF)
description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
extended_description: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
         

Fix information:
repo_url: https://github.com/hakobe/paranoidhttp
commit_details: repo_url: https://github.com/hakobe/paranoidhttp
author: Muhamad Visat Sutarno
author_date: 2019-04-22 15:08:55+07:00
msg: fix ipv6 unspecified address
repository: repo_url: https://github.com/hakobe/paranoidhttp
repo_name: hakobe/paranoidhttp
description: Paranoidhttp provides a pre-configured http.Client that protects you from harm.
repo_language: Go
owner: hakobe
file_changes: filename: client.go
change_type: ModificationType.MODIFY
diff: @@ -121,7 +121,7 @@ func safeAddr(ctx context.Context, resolver *net.Resolver, hostport string, opts
 
 	ip := net.ParseIP(host)
 	if ip != nil {
-		if ip.To4() != nil && c.isIPForbidden(ip) {
+		if ip.IsUnspecified() || (ip.To4() != nil && c.isIPForbidden(ip)) {
 			return "", fmt.Errorf("bad ip is detected: %v", ip)
 		}
 		return net.JoinHostPort(ip.String(), port), nil

programming_language: Go
filename: client_test.go
change_type: ModificationType.MODIFY
diff: @@ -19,6 +19,10 @@ func TestRequest(t *testing.T) {
 	if _, err := DefaultClient.Get("http://192.168.0.1"); err == nil {
 		t.Errorf("The request for localhost should be fail")
 	}
+
+	if _, err := DefaultClient.Get("http://[::]"); err == nil {
+		t.Errorf("The request for IPv6 unspecified address should be fail")
+	}
 }
 
 func TestIsHostForbidden(t *testing.T) {

programming_language: Go