starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-27516 (published 2021-02-22T00:15Z)

URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\\/ and interprets the URI as a relative path.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/medialize/URI.js
commit_details: repo_url: https://github.com/medialize/URI.js
author: Rodney Rehm
author_date: 2021-02-13 16:05:10+01:00
msg: fix(parse): treat backslash as forwardslash in scheme delimiter

make `https:/\attacker.com` like `https:\/attacker.com` result in `https://attacker.com/`
repository: repo_url: https://github.com/medialize/URI.js
repo_name: medialize/URI.js
description: Javascript URL mutation library
repo_language: JavaScript
owner: medialize
file_changes: filename: URI.js
change_type: ModificationType.MODIFY
diff: @@ -526,7 +526,7 @@
         if (parts.protocol && !parts.protocol.match(URI.protocol_expression)) {
           // : may be within the path
           parts.protocol = undefined;
-        } else if (string.substring(pos + 1, pos + 3) === '//') {
+        } else if (string.substring(pos + 1, pos + 3).replace(/\\/g, '/') === '//') {
           string = string.substring(pos + 3);
 
           // extract "user:pass@host:port"

programming_language: JavaScript
filename: urls.js
change_type: ModificationType.MODIFY
diff: @@ -2082,6 +2082,55 @@ var urls = [{
         idn: false,
         punycode: false
       }
+    }, {
+      name: 'backslashes protocol',
+      url: 'https:/\\attacker.com',
+      _url: 'https://attacker.com/',
+      parts: {
+        protocol: 'https',
+        username: null,
+        password: null,
+        hostname: 'attacker.com',
+        port: null,
+        path: '/',
+        query: null,
+        fragment: null
+      },
+      accessors: {
+        protocol: 'https',
+        username: '',
+        password: '',
+        port: '',
+        path: '/',
+        query: '',
+        fragment: '',
+        resource: '/',
+        authority: 'attacker.com',
+        origin: 'https://attacker.com',
+        userinfo: '',
+        subdomain: '',
+        domain: 'attacker.com',
+        tld: 'com',
+        directory: '/',
+        filename: '',
+        suffix: '',
+        hash: '',
+        search: '',
+        host: 'attacker.com',
+        hostname: 'attacker.com'
+      },
+      is: {
+        urn: false,
+        url: true,
+        relative: false,
+        name: true,
+        sld: false,
+        ip: false,
+        ip4: false,
+        ip6: false,
+        idn: false,
+        punycode: false
+      }
     }
 ];
 

programming_language: CoffeeScript
CVE-2020-20276 (published 2020-12-18T19:15Z)

An unauthenticated stack-based buffer overflow vulnerability in common.c's handle_PORT in uftpd FTP server versions 2.10 and earlier can be abused to cause a crash and could potentially lead to remote code execution.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/troglobit/uftpd
commit_details: repo_url: https://github.com/troglobit/uftpd
author: Joachim Nilsson
author_date: 2019-08-31 10:07:39+02:00
msg: FTP: Fix buffer overflow in PORT parser, reported by Aaron Esau

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>
repository: repo_url: https://github.com/troglobit/uftpd
repo_name: troglobit/uftpd
description: FTP/TFTP server for Linux that just works™
repo_language: C
owner: troglobit
file_changes: filename: ftpcmd.c
change_type: ModificationType.MODIFY
diff: @@ -441,7 +441,7 @@ static void handle_PORT(ctrl_t *ctrl, char *str)
 
 	/* Convert PORT command's argument to IP address + port */
 	sscanf(str, "%d,%d,%d,%d,%d,%d", &a, &b, &c, &d, &e, &f);
-	sprintf(addr, "%d.%d.%d.%d", a, b, c, d);
+	snprintf(addr, sizeof(addr), "%d.%d.%d.%d", a, b, c, d);
 
 	/* Check IPv4 address using inet_aton(), throw away converted result */
 	if (!inet_aton(addr, &(sin.sin_addr))) {

programming_language: C
CVE-2023-1170 (published 2023-03-03T23:15Z)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.

CVSS v3 base score: 6.6, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2023-03-03 21:11:52+00:00
msg: patch 9.0.1376: accessing invalid memory with put in Visual block mode

Problem:    Accessing invalid memory with put in Visual block mode.
Solution:   Adjust the cursor column if needed.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: register.c
change_type: ModificationType.MODIFY
diff: @@ -1928,7 +1928,7 @@ do_put(
 		ptr += yanklen;
 
 		// insert block's trailing spaces only if there's text behind
-		if ((j < count - 1 || !shortline) && spaces)
+		if ((j < count - 1 || !shortline) && spaces > 0)
 		{
 		    vim_memset(ptr, ' ', (size_t)spaces);
 		    ptr += spaces;
@@ -2284,6 +2284,15 @@ error:
     msgmore(nr_lines);
     curwin->w_set_curswant = TRUE;
 
+    // Make sure the cursor is not after the NUL.
+    int len = (int)STRLEN(ml_get_curline());
+    if (curwin->w_cursor.col > len)
+    {
+	if (cur_ve_flags == VE_ALL)
+	    curwin->w_cursor.coladd = curwin->w_cursor.col - len;
+	curwin->w_cursor.col = len;
+    }
+
 end:
     if (cmdmod.cmod_flags & CMOD_LOCKMARKS)
     {

programming_language: C
filename: test_put.vim
change_type: ModificationType.MODIFY
diff: @@ -231,5 +231,16 @@ func Test_put_visual_mode()
   set selection&
 endfunc
 
+func Test_put_visual_block_mode()
+  enew
+  exe "norm 0R\<CR>\<C-C>V"
+  sil exe "norm \<C-V>c	\<MiddleDrag>"
+  set ve=all
+  sil norm vz=p
+
+  bwipe!
+  set ve=
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -695,6 +695,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1376,
 /**/
     1375,
 /**/

programming_language: Ruby
CVE-2018-15864 (published 2018-08-25T21:29Z)

Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/xkbcommon/libxkbcommon
commit_details: repo_url: https://github.com/xkbcommon/libxkbcommon
author: Daniel Stone
author_date: 2017-06-26 16:45:16+01:00
msg: parser: Don't set more maps when we don't have any

If the scanner indicates that we might have something which looks like a
map, but the parser in fact fails to create that map, we will try to
access the map regardless. Stop doing that.

testcase: 'xkb_keymap {' -> '#kb_keymap'

Signed-off-by: Daniel Stone <daniels@collabora.com>
repository: repo_url: https://github.com/xkbcommon/libxkbcommon
repo_name: xkbcommon/libxkbcommon
description: keymap handling library for toolkits and window systems
repo_language: C
owner: xkbcommon
file_changes: filename: parser.y
change_type: ModificationType.MODIFY
diff: @@ -239,9 +239,9 @@ resolve_keysym(const char *name, xkb_keysym_t *sym_rtrn)
  */
 
 XkbFile         :       XkbCompositeMap
-                        { $$ = param->rtrn = $1; param->more_maps = true; }
+                        { $$ = param->rtrn = $1; param->more_maps = !!param->rtrn; }
                 |       XkbMapConfig
-                        { $$ = param->rtrn = $1; param->more_maps = true; YYACCEPT; }
+                        { $$ = param->rtrn = $1; param->more_maps = !!param->rtrn; YYACCEPT; }
                 |       END_OF_FILE
                         { $$ = param->rtrn = NULL; param->more_maps = false; }
                 ;
@@ -772,6 +772,7 @@ parse(struct xkb_context *ctx, struct scanner *scanner, const char *map)
         .scanner = scanner,
         .ctx = ctx,
         .rtrn = NULL,
+        .more_maps = false,
     };
 
     /*

programming_language: C
CVE-2019-13134 (published 2019-07-01T20:15Z)

ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2019-06-18 11:51:46-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1600
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: bmp.c
change_type: ModificationType.MODIFY
diff: @@ -1506,7 +1506,7 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
         if (GetNextImageInList(image) == (Image *) NULL)
           {
             status=MagickFalse;
-            return((Image *) NULL);
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),

programming_language: Objective-C
filename: viff.c
change_type: ModificationType.MODIFY
diff: @@ -773,8 +773,8 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),

programming_language: Objective-C
CVE-2020-36659 (published 2023-01-27T05:15Z)

In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.

CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-295
cwe_name: Improper Certificate Validation
description: The product does not validate, or incorrectly validates, a certificate.
extended_description: When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
         

Fix information:
repo_url: https://github.com/LemonLDAPNG/Apache-Session-Browseable
commit_details: repo_url: https://github.com/LemonLDAPNG/Apache-Session-Browseable
author: Maxime Besson
author_date: 2020-07-30 10:24:44+02:00
msg: Add ldapVerify option for SSL cert validation
repository: repo_url: https://github.com/LemonLDAPNG/Apache-Session-Browseable
repo_name: LemonLDAPNG/Apache-Session-Browseable
description: Apache::Session::Browseable Perl module
repo_language: Perl
owner: LemonLDAPNG
file_changes: filename: LDAP.pm
change_type: ModificationType.MODIFY
diff: @@ -154,10 +154,18 @@ sub ldap {
         push @servers, $server;
     }
 
+    # Compatibility
+    my $caFile = $self->{args}->{ldapCAFile} || $self->{args}->{caFile};
+    my $caPath = $self->{args}->{ldapCAPath} || $self->{args}->{caPath};
+
     # Connect
     my $ldap = Net::LDAP->new(
         \@servers,
         onerror => undef,
+        verify => $self->{args}->{ldapVerify} || "require",
+	( $caFile ? ( cafile => $caFile ) : () ),
+	( $caPath ? ( capath => $caPath ) : () ),
+
         (
             $self->{args}->{ldapRaw} ? ( raw => $self->{args}->{ldapRaw} )
             : ()
@@ -169,10 +177,12 @@ sub ldap {
     ) or die( 'Unable to connect to ' . join( ' ', @servers ) );
 
     # Start TLS if needed
+
     if ($useTls) {
         my %h = split( /[&=]/, $tlsParam );
-        $h{cafile} = $self->{args}->{caFile} if ( $self->{args}->{caFile} );
-        $h{capath} = $self->{args}->{caPath} if ( $self->{args}->{caPath} );
+        $h{verify} = $self->{args}->{ldapVerify} || "require";
+        $h{cafile} = $caFile if ( $caFile );
+        $h{capath} = $caPath if ( $caPath );
         my $start_tls = $ldap->start_tls(%h);
         if ( $start_tls->code ) {
             $self->logError($start_tls);

programming_language: Perl
CVE-2022-23462 (published 2022-10-21T22:15Z)

IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service (DOS) when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit a79d31e4cff1d5a08f665574b29fd885897a28fd in the `master` branch of the repository. There are no workarounds other than applying the patch.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/Softmotions/iowow
commit_details: repo_url: https://github.com/Softmotions/iowow
author: Anton Adamansky
author_date: 2022-08-25 12:30:36+07:00
msg: * Fixed Github Vulnerability Report GHSL-2022-066
repository: repo_url: https://github.com/Softmotions/iowow
repo_name: Softmotions/iowow
description: A C utility library and persistent key/value storage engine
repo_language: C
owner: Softmotions
file_changes: filename: Changelog
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,6 @@
 iowow (1.4.16) UNRELEASED; urgency=medium
 
+  * Fixed Github Vulnerability Report GHSL-2022-066
   * Added additional IW_ERROR_XX codes (iwlog.h)
   * Added VERBOSE log level (iwlog.h)
   * Added iwhmap_put_str() (iwhmap.h)

programming_language: Markdown
filename: iwjson.c
change_type: ModificationType.MODIFY
diff: @@ -26,7 +26,7 @@ static void _jbn_add_item(JBL_NODE parent, JBL_NODE node);
 
 void iwjson_ftoa(long double val, char buf[static IWNUMBUF_SIZE], size_t *out_len) {
   // TODO: review
-  int len = snprintf(buf, 64, "%.8Lf", val);
+  int len = snprintf(buf, IWNUMBUF_SIZE, "%.8Lf", val);
   if (len <= 0) {
     buf[0] = '\0';
     *out_len = 0;

programming_language: C
CVE-2023-1539 (published 2023-03-21T05:15Z)

Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-307
cwe_name: Improper Restriction of Excessive Authentication Attempts
description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/answerdev/answer
commit_details: repo_url: https://github.com/answerdev/answer
author: aichy126
author_date: 2023-02-24 16:30:21+08:00
msg: update VerifyCaptcha
repository: repo_url: https://github.com/answerdev/answer
repo_name: apache/incubator-answer
description: A Q&A platform software for teams at any scales. Whether it's a community forum, help center, or knowledge management platform, you can always count on Apache Answer.
repo_language: Go
owner: answerdev
file_changes: filename: captcha.go
change_type: ModificationType.MODIFY
diff: @@ -68,3 +68,11 @@ func (cr *captchaRepo) GetCaptcha(ctx context.Context, key string) (captcha stri
 	}
 	return captcha, nil
 }
+
+func (cr *captchaRepo) DelCaptcha(ctx context.Context, key string) (err error) {
+	err = cr.data.Cache.Del(ctx, key)
+	if err != nil {
+		log.Debug(err)
+	}
+	return nil
+}

programming_language: Go
filename: captcha_service.go
change_type: ModificationType.MODIFY
diff: @@ -16,6 +16,7 @@ import (
 type CaptchaRepo interface {
 	SetCaptcha(ctx context.Context, key, captcha string) (err error)
 	GetCaptcha(ctx context.Context, key string) (captcha string, err error)
+	DelCaptcha(ctx context.Context, key string) (err error)
 	SetActionType(ctx context.Context, ip, actionType string, amount int) (err error)
 	GetActionType(ctx context.Context, ip, actionType string) (amount int, err error)
 	DelActionType(ctx context.Context, ip, actionType string) (err error)
@@ -143,6 +144,12 @@ func (cs *CaptchaService) GenerateCaptcha(ctx context.Context) (key, captchaBase
 func (cs *CaptchaService) VerifyCaptcha(ctx context.Context, key, captcha string) (isCorrect bool, err error) {
 	realCaptcha, err := cs.captchaRepo.GetCaptcha(ctx, key)
 	if err != nil {
+		log.Error("VerifyCaptcha GetCaptcha Error", err.Error())
+		return false, nil
+	}
+	err = cs.captchaRepo.DelCaptcha(ctx, key)
+	if err != nil {
+		log.Error("VerifyCaptcha DelCaptcha Error", err.Error())
 		return false, nil
 	}
 	return strings.TrimSpace(captcha) == realCaptcha, nil

programming_language: Go
CVE-2016-3137 (published 2016-05-02T10:59Z)

drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an interrupt-in and an interrupt-out endpoint descriptor, related to the cypress_generic_port_probe and cypress_open functions.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 4.6, MEDIUM (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Oliver Neukum
author_date: 2016-03-31 12:04:25-04:00
msg: USB: cypress_m8: add endpoint sanity check

An attack using missing endpoints exists.

CVE-2016-3137

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
CC: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: cypress_m8.c
change_type: ModificationType.MODIFY
diff: @@ -447,6 +447,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port)
 	struct usb_serial *serial = port->serial;
 	struct cypress_private *priv;
 
+	if (!port->interrupt_out_urb || !port->interrupt_in_urb) {
+		dev_err(&port->dev, "required endpoint is missing\n");
+		return -ENODEV;
+	}
+
 	priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL);
 	if (!priv)
 		return -ENOMEM;
@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port)
 		cypress_set_termios(tty, port, &priv->tmp_termios);
 
 	/* setup the port and start reading from the device */
-	if (!port->interrupt_in_urb) {
-		dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n",
-			__func__);
-		return -1;
-	}
-
 	usb_fill_int_urb(port->interrupt_in_urb, serial->dev,
 		usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress),
 		port->interrupt_in_urb->transfer_buffer,

programming_language: C
CVE-2019-10911 (published 2019-05-16T22:29Z)

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.

Severity: MEDIUM
CVSS v2 base score: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/symfony/symfony
commit_details: repo_url: https://github.com/symfony/symfony
author: Pascal Borreli
author_date: 2019-04-06 11:40:18+01:00
msg: [Security] Add a separator in the remember me cookie hash
repository: repo_url: https://github.com/symfony/symfony
repo_name: symfony/symfony
description: The Symfony PHP framework
repo_language: PHP
owner: symfony
file_changes: filename: TokenBasedRememberMeServices.php
change_type: ModificationType.MODIFY
diff: @@ -120,6 +120,6 @@ class TokenBasedRememberMeServices extends AbstractRememberMeServices
      */
     protected function generateCookieHash($class, $username, $expires, $password)
     {
-        return hash_hmac('sha256', $class.$username.$expires.$password, $this->getSecret());
+        return hash_hmac('sha256', $class.self::COOKIE_DELIMITER.$username.self::COOKIE_DELIMITER.$expires.self::COOKIE_DELIMITER.$password, $this->getSecret());
     }
 }

programming_language: PHP