starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-34702 (published 2024-07-08T17:15Z)

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/randombit/botan
commit_details: repo_url: https://github.com/randombit/botan
author: Jack Lloyd
author_date: 2024-05-13 06:49:29-04:00
msg: Merge pull request #4045 from randombit/jack/x509-path-sigs-first

During X509 path validation, return immediately if a signature is invalid
repository: repo_url: https://github.com/randombit/botan
repo_name: randombit/botan
description: Cryptography Toolkit
repo_language: C++
owner: randombit
repo_url: https://github.com/randombit/botan
commit_details: repo_url: https://github.com/randombit/botan
author: Jack Lloyd
author_date: 2024-05-10 05:02:43-04:00
msg: Merge pull request #4034 from randombit/jack/refactor-alt-name

Refactor AlternativeName internals
repository: repo_url: https://github.com/randombit/botan
repo_name: randombit/botan
description: Cryptography Toolkit
repo_language: C++
owner: randombit
repo_url: https://github.com/randombit/botan
commit_details: repo_url: https://github.com/randombit/botan
author: Jack Lloyd
author_date: 2024-05-14 04:37:15-04:00
msg: Merge pull request #4047 from randombit/jack/opt-name-constraints

Optimize name constraint matching
repository: repo_url: https://github.com/randombit/botan
repo_name: randombit/botan
description: Cryptography Toolkit
repo_language: C++
owner: randombit
repo_url: https://github.com/randombit/botan
commit_details: repo_url: https://github.com/randombit/botan
author: Jack Lloyd
author_date: 2024-07-08 10:39:41-04:00
msg: Merge pull request #4186 from randombit/jack/fix-nc-dos

Address denial of service in name constraints processing
repository: repo_url: https://github.com/randombit/botan
repo_name: randombit/botan
description: Cryptography Toolkit
repo_language: C++
owner: randombit
CVE-2021-4262 (published 2022-12-19T14:15Z)

A vulnerability classified as critical was found in laravel-jqgrid. Affected by this vulnerability is the function getRows of the file src/Mgallegos/LaravelJqgrid/Repositories/EloquentRepositoryAbstract.php. The manipulation leads to sql injection. The name of the patch is fbc2d94f43d0dc772767a5bdb2681133036f935e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216271.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/mgallegos/laravel-jqgrid
commit_details: repo_url: https://github.com/mgallegos/laravel-jqgrid
author: Mario Gallegos
author_date: 2021-07-28 08:20:41-06:00
msg: Merge pull request #72 from wuwx/patch-2

preventing sql injection
repository: repo_url: https://github.com/mgallegos/laravel-jqgrid
repo_name: mgallegos/laravel-jqgrid
description: @Laravel jqGrid package allows you to easily integrate the popular @jQuery Grid Plugin (jqGrid) into your Laravel application.
repo_language: PHP
owner: mgallegos
CVE-2022-43995 (published 2022-11-02T14:15Z)

Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture.

CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/sudo-project/sudo
commit_details: repo_url: https://github.com/sudo-project/sudo
author: Todd C. Miller
author_date: 2022-10-28 07:29:55-06:00
msg: Fix CVE-2022-43995, potential heap overflow for passwords < 8 characters.
Starting with sudo 1.8.0 the plaintext password buffer is dynamically
sized so it is not safe to assume that it is at least 9 bytes in size.
Found by Hugo Lefeuvre (University of Manchester) with ConfFuzz.
repository: repo_url: https://github.com/sudo-project/sudo
repo_name: sudo-project/sudo
description: Utility to execute a command as another user
repo_language: C
owner: sudo-project
file_changes: filename: passwd.c
change_type: ModificationType.MODIFY
diff: @@ -63,7 +63,7 @@ sudo_passwd_init(struct passwd *pw, sudo_auth *auth)
 int
 sudo_passwd_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_conv_callback *callback)
 {
-    char sav, *epass;
+    char des_pass[9], *epass;
     char *pw_epasswd = auth->data;
     size_t pw_len;
     int matched = 0;
@@ -75,12 +75,12 @@ sudo_passwd_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_c
 
     /*
      * Truncate to 8 chars if standard DES since not all crypt()'s do this.
-     * If this turns out not to be safe we will have to use OS #ifdef's (sigh).
      */
-    sav = pass[8];
     pw_len = strlen(pw_epasswd);
-    if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len))
-	pass[8] = '\0';
+    if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len)) {
+	strlcpy(des_pass, pass, sizeof(des_pass));
+	pass = des_pass;
+    }
 
     /*
      * Normal UN*X password check.
@@ -88,7 +88,6 @@ sudo_passwd_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_c
      * only compare the first DESLEN characters in that case.
      */
     epass = (char *) crypt(pass, pw_epasswd);
-    pass[8] = sav;
     if (epass != NULL) {
 	if (HAS_AGEINFO(pw_epasswd, pw_len) && strlen(epass) == DESLEN)
 	    matched = !strncmp(pw_epasswd, epass, DESLEN);

programming_language: C
CVE-2014-9421 (published 2015-02-19T11:59Z)

The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind.

Severity: HIGH
CVSS v2 base score: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/krb5/krb5
commit_details: repo_url: https://github.com/krb5/krb5
author: Greg Hudson
author_date: 2014-12-27 14:16:13-05:00
msg: Fix kadm5/gssrpc XDR double free [CVE-2014-9421]

[MITKRB5-SA-2015-001] In auth_gssapi_unwrap_data(), do not free
partial deserialization results upon failure to deserialize.  This
responsibility belongs to the callers, svctcp_getargs() and
svcudp_getargs(); doing it in the unwrap function results in freeing
the results twice.

In xdr_krb5_tl_data() and xdr_krb5_principal(), null out the pointers
we are freeing, as other XDR functions such as xdr_bytes() and
xdr_string().

ticket: 8056 (new)
target_version: 1.13.1
tags: pullup
repository: repo_url: https://github.com/krb5/krb5
repo_name: krb5/krb5
description: mirror of MIT krb5 repository
repo_language: C
owner: krb5
file_changes: filename: kadm_rpc_xdr.c
change_type: ModificationType.MODIFY
diff: @@ -320,6 +320,7 @@ bool_t xdr_krb5_tl_data(XDR *xdrs, krb5_tl_data **tl_data_head)
 	       free(tl);
 	       tl = tl2;
 	  }
+	  *tl_data_head = NULL;
 	  break;
 
      case XDR_ENCODE:
@@ -1096,6 +1097,7 @@ xdr_krb5_principal(XDR *xdrs, krb5_principal *objp)
     case XDR_FREE:
 	if(*objp != NULL)
 	    krb5_free_principal(context, *objp);
+	*objp = NULL;
 	break;
     }
     return TRUE;

programming_language: C
filename: auth_gssapi_misc.c
change_type: ModificationType.MODIFY
diff: @@ -322,7 +322,6 @@ bool_t auth_gssapi_unwrap_data(
      if (! (*xdr_func)(&temp_xdrs, xdr_ptr)) {
 	  PRINTF(("gssapi_unwrap_data: deserializing arguments failed\n"));
 	  gss_release_buffer(minor, &out_buf);
-	  xdr_free(xdr_func, xdr_ptr);
 	  XDR_DESTROY(&temp_xdrs);
 	  return FALSE;
      }

programming_language: C
CVE-2023-37468 (published 2023-07-13T21:15Z)

Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2.\n\n

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-312
cwe_name: Cleartext Storage of Sensitive Information
description: The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
extended_description: 
	 Because the information is stored in cleartext (i.e., unencrypted), attackers could potentially read it. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.
	 When organizations adopt cloud services, it can be easier for attackers to access the data from anywhere on the Internet.
	 In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
       
         

Fix information:
repo_url: https://github.com/thm-mni-ii/feedbacksystem
commit_details: repo_url: https://github.com/thm-mni-ii/feedbacksystem
author: Pia-Doreen Ritzke
author_date: 2023-06-22 14:26:44+02:00
msg: Merge pull request from GHSA-g28r-8wg3-7349

passwords
repository: repo_url: https://github.com/thm-mni-ii/feedbacksystem
repo_name: thm-mni-ii/feedbacksystem
description: Intelligent, personalized feedback for students using artificial intelligence
repo_language: Scala
owner: thm-mni-ii
file_changes: filename: LoginController.scala
change_type: ModificationType.MODIFY
diff: @@ -118,11 +118,11 @@ class LoginController extends CasClientConfigurerAdapter {
         password <- jsonNode.retrive("password").asText()
         ldapUser <- ldapService.login(username, password)
         user <- loadUserFromLdap(ldapUser.getAttribute("uid").getStringValue)
-      } yield (user, password)
+      } yield user
 
       login match {
-        case Some((user, password)) =>
-          val localUser = userService.find(user.username).getOrElse(userService.create(user, password))
+        case Some((user)) =>
+          val localUser = userService.find(user.username).getOrElse(userService.create(user, null))
           authService.renewAuthentication(localUser, response)
         case None => throw new UnauthorizedException()
       }

programming_language: Scala
CVE-2020-10931 (published 2020-03-24T15:15Z)

Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binary in memcached.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/memcached/memcached
commit_details: repo_url: https://github.com/memcached/memcached
author: dormando
author_date: 2020-03-23 10:16:33-07:00
msg: Fix security issue reported by someone.

someone will get their name attributed for future issues if they bother
following procedure.
repository: repo_url: https://github.com/memcached/memcached
repo_name: memcached/memcached
description: memcached development tree
repo_language: C
owner: memcached
file_changes: filename: memcached.c
change_type: ModificationType.MODIFY
diff: @@ -6175,8 +6175,9 @@ static int try_read_command_binary(conn *c) {
         // want to refactor a ton of code either. Header is only ever used out
         // of c->binary_header, but the extlen stuff is used for the latter
         // bytes. Just wastes 24 bytes on the stack this way.
-        char extbuf[sizeof(c->binary_header) + BIN_MAX_EXTLEN];
-        memcpy(extbuf + sizeof(c->binary_header), c->rcurr + sizeof(c->binary_header), extlen);
+        char extbuf[sizeof(c->binary_header) + BIN_MAX_EXTLEN+1];
+        memcpy(extbuf + sizeof(c->binary_header), c->rcurr + sizeof(c->binary_header),
+                extlen > BIN_MAX_EXTLEN ? BIN_MAX_EXTLEN : extlen);
         c->rbytes -= sizeof(c->binary_header) + extlen + keylen;
         c->rcurr += sizeof(c->binary_header) + extlen + keylen;
 

programming_language: C
CVE-2024-40129 (published 2024-07-16T19:15Z)

Open5GS v2.6.4 is vulnerable to Buffer Overflow. via /lib/pfcp/context.c.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/open5gs/open5gs
commit_details: repo_url: https://github.com/open5gs/open5gs
author: Sukchan Lee
author_date: 2023-09-06 07:13:14+09:00
msg: [PFCP] Fixed Possible heap buffer overflow (#2585)

After examining the call stack and reading the source code, I found that
in /lib/core/ogs-pool.h line 152: (pool)->array[i] = i+1;
then in lib/pfcp/context.c line 78: pdr_random_to_index[ogs_pfcp_pdr_teid_pool.array[i]] = i;
ogs_pfcp_pdr_teid_pool.array[i] may exceed the size of pdr_random_to_index, leading to a heap-buffer-overflow.
repository: repo_url: https://github.com/open5gs/open5gs
repo_name: open5gs/open5gs
description: Open5GS is a C-language Open Source implementation for 5G Core and EPC, i.e. the core network of LTE/NR network (Release-17)
repo_language: C
owner: open5gs
file_changes: filename: context.c
change_type: ModificationType.MODIFY
diff: @@ -72,7 +72,7 @@ void ogs_pfcp_context_init(void)
     ogs_pool_random_id_generate(&ogs_pfcp_pdr_teid_pool);
 
     pdr_random_to_index = ogs_calloc(
-            sizeof(ogs_pool_id_t), ogs_pfcp_pdr_pool.size);
+            sizeof(ogs_pool_id_t), ogs_pfcp_pdr_pool.size+1);
     ogs_assert(pdr_random_to_index);
     for (i = 0; i < ogs_pfcp_pdr_pool.size; i++)
         pdr_random_to_index[ogs_pfcp_pdr_teid_pool.array[i]] = i;

programming_language: C
CVE-2017-9224 (published 2017-05-24T15:29Z)

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/kkos/oniguruma
commit_details: repo_url: https://github.com/kkos/oniguruma
author: K.Kosako
author_date: 2017-05-23 10:28:58+09:00
msg: fix #57 : DATA_ENSURE() check must be before data access
repository: repo_url: https://github.com/kkos/oniguruma
repo_name: kkos/oniguruma
description: regular expression library
repo_language: C
owner: kkos
file_changes: filename: regexec.c
change_type: ModificationType.MODIFY
diff: @@ -1473,14 +1473,9 @@ match_at(regex_t* reg, const UChar* str, const UChar* end,
       break;
 
     case OP_EXACT1:  MOP_IN(OP_EXACT1);
-#if 0
       DATA_ENSURE(1);
       if (*p != *s) goto fail;
       p++; s++;
-#endif
-      if (*p != *s++) goto fail;
-      DATA_ENSURE(0);
-      p++;
       MOP_OUT;
       break;
 

programming_language: C
CVE-2022-33146 (published 2022-06-27T01:15Z)

Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/web2py/web2py
commit_details: repo_url: https://github.com/web2py/web2py
author: Massimo Di Pierro
author_date: 2022-06-04 10:57:08-07:00
msg: added validation of send attribute in admin
repository: repo_url: https://github.com/web2py/web2py
repo_name: web2py/web2py
description: Free and open source full-stack enterprise framework for agile development of secure database-driven web-based applications, written and programmable in Python.
repo_language: Python
owner: web2py
file_changes: filename: default.py
change_type: ModificationType.MODIFY
diff: @@ -12,7 +12,7 @@ import re
 from gluon.admin import *
 from gluon.fileutils import abspath, read_file, write_file
 from gluon.utils import web2py_uuid
-from gluon.tools import Config
+from gluon.tools import Config, prevent_open_redirect
 from gluon.compileapp import find_exposed_functions
 from glob import glob
 from gluon._compat import iteritems, PY2, pickle, xrange, urlopen, to_bytes, StringIO, to_native, reload
@@ -118,7 +118,7 @@ def get_app(name=None):
 def index():
     """ Index handler """
 
-    send = request.vars.send
+    send = prevent_open_redirect(request.vars.send)
     if DEMO_MODE:
         session.authorized = True
         session.last_time = t0

programming_language: Python
CVE-2018-14371 (published 2018-07-18T12:29Z)

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/eclipse-ee4j/mojarra
commit_details: repo_url: https://github.com/eclipse-ee4j/mojarra
author: Zhijun Ren
author_date: 2018-05-11 16:02:52+08:00
msg: fixing CTS failure issue in master branch
repository: repo_url: https://github.com/eclipse-ee4j/mojarra
repo_name: eclipse-ee4j/mojarra
description: Mojarra, a Jakarta Faces implementation
repo_language: Java
owner: eclipse-ee4j
file_changes: filename: InstanceFactory.java
change_type: ModificationType.MODIFY
diff: @@ -288,6 +288,10 @@ public class InstanceFactory {
     }
     
     public UIComponent createComponent(FacesContext context, String componentType, String rendererType) {
+        
+        notNull(CONTEXT, context);
+        notNull(COMPONENT_TYPE, componentType);
+        
         return createComponentApplyAnnotations(context, componentType, rendererType, true);
     }
     

programming_language: Java
filename: ResourceManager.java
change_type: ModificationType.MODIFY
diff: @@ -565,7 +565,7 @@ public class ResourceManager {
         
         localePrefix = context.getExternalContext().getRequestParameterMap().get("loc");
         
-        if(localePrefix != null){
+        if(localePrefix != null && !nameContainsForbiddenSequence(localePrefix)){
             return localePrefix;
         }
         

programming_language: Java