starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-37646 (published 2021-08-12T21:15Z)

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.StringNGrams` is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/string_ngrams_op.cc#L184) calls `reserve` on a `tstring` with a value that sometimes can be negative if user supplies negative `ngram_widths`. The `reserve` method calls `TF_TString_Reserve` which has an `unsigned long` argument for the size of the buffer. Hence, the implicit conversion transforms the negative value to a large integer. We have patched the issue in GitHub commit c283e542a3f422420cfdb332414543b62fc4e4a5. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-681
cwe_name: Incorrect Conversion between Numeric Types
description: When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Laura Pak
author_date: 2021-07-27 10:55:35-07:00
msg: Disallow negative ngram_widths values in tf.raw_ops.StringNGrams

PiperOrigin-RevId: 387148179
Change-Id: I641395a09a208be72ef9b3ceb128cf8a83a0775b
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: string_ngrams_op.cc
change_type: ModificationType.MODIFY
diff: @@ -53,6 +53,12 @@ class StringNGramsOp : public tensorflow::OpKernel {
   }
 
   void Compute(tensorflow::OpKernelContext* context) override {
+    for (int ngram_width : ngram_widths_) {
+      OP_REQUIRES(
+          context, ngram_width > 0,
+          errors::InvalidArgument("ngram_widths must contain positive values"));
+    }
+
     const tensorflow::Tensor* data;
     OP_REQUIRES_OK(context, context->input("data", &data));
     const auto& input_data = data->flat<tstring>().data();

programming_language: C++
CVE-2021-21293 (published 2021-02-02T22:15Z)

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a dedicated thread pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an unbounded queue. Each connection allocates a socket handle, which drains a scarce OS resource. This can also confound higher level circuit breakers which work based on detecting failed connections. The vast majority of affected users are using it as part of http4s-blaze-server <= 0.21.16. http4s provides a mechanism for limiting open connections, but is enforced inside the Blaze accept loop, after the connection is accepted and the socket opened. Thus, the limit only prevents the number of connections which can be simultaneously processed, not the number of connections which can be held open. The issue is fixed in version 0.14.15 for "NIO1SocketServerGroup". A "maxConnections" parameter is added, with a default value of 512. Concurrent connections beyond this limit are rejected. To run unbounded, which is not recommended, set a negative number. The "NIO2SocketServerGroup" has no such setting and is now deprecated. There are several possible workarounds described in the refrenced GitHub Advisory GHSA-xmw9-q7x9-j5qc.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-770
cwe_name: Allocation of Resources Without Limits or Throttling
description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
extended_description: Code frequently has to work with limited resources, so programmers must be careful to ensure that resources are not consumed too quickly, or too easily.  Without use of quotas, resource limits, or other protection mechanisms, it can be easy for an attacker to consume many resources by rapidly making many requests, or causing larger resources to be used than is needed. When too many resources are allocated, or if a single resource is too large, then it can prevent the code from working correctly, possibly leading to a denial of service.
         

Fix information:
repo_url: https://github.com/http4s/blaze
commit_details: repo_url: https://github.com/http4s/blaze
author: Ross A. Baker
author_date: 2021-02-02 10:48:42-05:00
msg: Merge pull request from GHSA-xmw9-q7x9-j5qc

Fix GHSA-xmw9-q7x9-j5qc by limiting accepted connections
repository: repo_url: https://github.com/http4s/blaze
repo_name: http4s/blaze
description: Blazing fast NIO microframework and Http Parser
repo_language: Scala
owner: http4s
CVE-2022-29780 (published 2022-06-02T14:15Z)

Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_prototype_sort at src/njs_array.c.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/nginx/njs
commit_details: repo_url: https://github.com/nginx/njs
author: Dmitry Volyntsev
author_date: 2022-04-22 17:02:28-07:00
msg: Fixed Array.prototype.sort() when arr size is changed in a comparator.

This fixed #468 issue on Github.
repository: repo_url: https://github.com/nginx/njs
repo_name: nginx/njs
description: A subset of JavaScript language to use in nginx
repo_language: C
owner: nginx
file_changes: filename: njs_array.c
change_type: ModificationType.MODIFY
diff: @@ -2696,7 +2696,7 @@ slow_path:
         goto exception;
     }
 
-    if (njs_fast_path(fast_path)) {
+    if (njs_fast_path(fast_path && njs_is_fast_array(this))) {
         array = njs_array(this);
         start = array->start;
 

programming_language: C
filename: njs_unit_test.c
change_type: ModificationType.MODIFY
diff: @@ -6989,6 +6989,9 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("[1,2].sort(1)"),
       njs_str("TypeError: comparefn must be callable or undefined") },
 
+    { njs_str("var a = [1,2]; a.sort(() => {a.length = 65535}); a.length"),
+      njs_str("65535") },
+
     /*
       Array.prototype.keys()
       Array.prototype.values()

programming_language: JavaScript
CVE-2022-0393 (published 2022-01-28T22:15Z)

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-01-27 19:27:16+00:00
msg: patch 8.2.4233: crash when recording and using Select mode

Problem:    Crash when recording and using Select mode.
Solution:   When deleting the last recorded character check there is something
            to delete.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: getchar.c
change_type: ModificationType.MODIFY
diff: @@ -252,8 +252,11 @@ add_buff(
     static void
 delete_buff_tail(buffheader_T *buf, int slen)
 {
-    int len = (int)STRLEN(buf->bh_curr->b_str);
+    int len;
 
+    if (buf->bh_curr == NULL || buf->bh_curr->b_str == NULL)
+	return;  // nothing to delete
+    len = (int)STRLEN(buf->bh_curr->b_str);
     if (len >= slen)
     {
 	buf->bh_curr->b_str[len - slen] = NUL;

programming_language: C
filename: test_registers.vim
change_type: ModificationType.MODIFY
diff: @@ -739,6 +739,15 @@ func Test_record_in_insert_mode()
   bwipe!
 endfunc
 
+func Test_record_in_select_mode()
+  new
+  call setline(1, 'text')
+  sil norm q00
+  sil norm q
+  call assert_equal('0ext', getline(1))
+  bwipe!
+endfunc
+
 " Make sure that y_append is correctly reset
 " and the previous register is working as expected
 func Test_register_y_append_reset()

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4233,
 /**/
     4232,
 /**/

programming_language: Ruby
CVE-2021-3845 (published 2022-01-04T17:15Z)

ws-scrcpy is vulnerable to External Control of File Name or Path

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-73
cwe_name: External Control of File Name or Path
description: The product allows user input to control or influence paths or file names that are used in filesystem operations.
extended_description: 
            This could allow an attacker to access or modify system files or other files that are critical to the application.
            Path manipulation errors occur when the following two conditions are met:
            
               1. An attacker can specify a path used in an operation on the filesystem.
               2. By specifying the resource, the attacker gains a capability that would not otherwise be permitted.
            
            For example, the program may give the attacker the ability to overwrite the specified file or run with a configuration controlled by the attacker.
         
         

Fix information:
repo_url: https://github.com/netristv/ws-scrcpy
commit_details: repo_url: https://github.com/netristv/ws-scrcpy
author: Sergey Volkov
author_date: 2021-12-15 20:14:56+03:00
msg: fix: file access outside the public dir
repository: repo_url: https://github.com/netristv/ws-scrcpy
repo_name: NetrisTV/ws-scrcpy
description: Web client prototype for scrcpy.
repo_language: TypeScript
owner: netristv
file_changes: filename: HttpServer.ts
change_type: ModificationType.MODIFY
diff: @@ -45,6 +45,11 @@ export class HttpServer implements Service {
             }
             const parsedUrl = url.parse(req.url);
             let pathname = path.join(publicDir, (parsedUrl.pathname || '.').replace(/^(\.)+/, '.'));
+            if (pathname.indexOf(publicDir) !== 0) {
+                res.statusCode = 403;
+                res.end();
+                return;
+            }
             fs.stat(pathname, (statErr, stat) => {
                 if (statErr) {
                     if (statErr.code === 'ENOENT') {

programming_language: TypeScript
CVE-2021-21238 (published 2021-01-21T15:15Z)

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-347
cwe_name: Improper Verification of Cryptographic Signature
description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/IdentityPython/pysaml2
commit_details: repo_url: https://github.com/IdentityPython/pysaml2
author: Ivan Kanakarakis
author_date: 2021-01-20 14:34:45+02:00
msg: Merge pull request from GHSA-f4g9-h89h-jgv9

Validate XML documents before verifying the signature
repository: repo_url: https://github.com/IdentityPython/pysaml2
repo_name: IdentityPython/pysaml2
description: Python implementation of SAML2
repo_language: Python
owner: IdentityPython
CVE-2019-16782 (published 2019-12-18T20:15Z)

There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.9, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-203
cwe_name: Observable Discrepancy
description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
extended_description: Discrepancies can take many forms, and variations may be detectable in timing, control flow, communications such as replies or requests, or general behavior. These discrepancies can reveal information about the product's operation or internal state to an unauthorized actor. In some cases, discrepancies can be used by attackers to form a side channel.
         

Fix information:
repo_url: https://github.com/rack/rack
commit_details: repo_url: https://github.com/rack/rack
author: Aaron Patterson
author_date: 2019-12-18 10:07:23-08:00
msg: Merge branch 'advisory-fix-1'

* advisory-fix-1:
  Introduce a new base class to avoid breaking when upgrading
  Add a version prefix to the private id to make easier to migrate old values
  Fallback to the public id when reading the session in the pool adapter
  Also drop the session with the public id when destroying sessions
  Fallback to the legacy id when the new id is not found
  Add the private id
  revert conditionals to master
  remove NullSession
  remove || raise and get closer to master
  store hashed id, send public id
  use session id objects
  remove more nils
  try to ensure we always have some kind of object
repository: repo_url: https://github.com/rack/rack
repo_name: rack/rack
description: A modular Ruby web server interface.
repo_language: Ruby
owner: rack
CVE-2021-33586 (published 2021-05-27T05:15Z)

InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-732
cwe_name: Incorrect Permission Assignment for Critical Resource
description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
extended_description: When a resource is given a permission setting that provides access to a wider range of actors than required, it could lead to the exposure of sensitive information, or the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution, or sensitive user data. For example, consider a misconfigured storage account for the cloud that can be read or written by a public or anonymous user.
         

Fix information:
repo_url: https://github.com/inspircd/inspircd
commit_details: repo_url: https://github.com/inspircd/inspircd
author: Sadie Powell
author_date: 2021-05-14 13:56:32+01:00
msg: Fix sending malformed pong messages in some cases.
repository: repo_url: https://github.com/inspircd/inspircd
repo_name: inspircd/inspircd
description: A modular C++ IRC server (ircd).
repo_language: C++
owner: inspircd
file_changes: filename: clientprotocolmsg.h
change_type: ModificationType.MODIFY
diff: @@ -668,9 +668,10 @@ struct ClientProtocol::Messages::Pong : public ClientProtocol::Message
 	Pong(const std::string& cookie, const std::string& server = "")
 		: ClientProtocol::Message("PONG", ServerInstance->Config->GetServerName())
 	{
-		PushParamRef(ServerInstance->Config->GetServerName());
-		if (!server.empty())
-			PushParamRef(server);
+		if (server.empty())
+			PushParamRef(ServerInstance->Config->GetServerName());
+		else
+			PushParam(server);
 		PushParamRef(cookie);
 	}
 };

programming_language: C++
filename: core_user.cpp
change_type: ModificationType.MODIFY
diff: @@ -83,7 +83,7 @@ class CommandPing : public SplitCommand
 			return CMD_FAILURE;
 		}
 
-		ClientProtocol::Messages::Pong pong(parameters[0], origin ? parameters[1] : "");
+		ClientProtocol::Messages::Pong pong(parameters[0], origin ? parameters[1] : ServerInstance->Config->GetServerName());
 		user->Send(ServerInstance->GetRFCEvents().pong, pong);
 		return CMD_SUCCESS;
 	}

programming_language: C++
CVE-2024-4253 (published 2024-06-04T08:15Z)

A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modification of the base repository or secrets exfiltration. The issue affects versions up to and including '@gradio/video@0.6.12'. The flaw is present in the workflow's handling of GitHub context information, where it echoes the full name of the head repository, the head branch, and the workflow reference without adequate sanitization. This could potentially lead to the exfiltration of sensitive secrets such as 'GITHUB_TOKEN', 'COMMENT_TOKEN', and 'CHROMATIC_PROJECT_TOKEN'.


Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/gradio-app/gradio
commit_details: repo_url: https://github.com/gradio-app/gradio
author: Lê Ngọc Hoa
author_date: 2024-05-01 21:41:27+07:00
msg: Update test-functional.yml - Fix vulnerability code injection (#8145)

* Update test-functional.yml

* Update test-functional.yml

* tweaks

---------

Co-authored-by: pngwn <hello@pngwn.io>
repository: repo_url: https://github.com/gradio-app/gradio
repo_name: gradio-app/gradio
description: Build and share delightful machine learning apps, all in Python. 🌟 Star to support our work!
repo_language: Python
owner: gradio-app
file_changes: filename: test-functional.yml
change_type: ModificationType.MODIFY
diff: @@ -32,9 +32,6 @@ jobs:
         with:
           type: "functional"
           token: ${{ secrets.GITHUB_TOKEN }}
-      - name: echo github context
-        if: always()
-        run: echo "${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}-${{ github.workflow_ref }}"
 
   test-functional:
     name: "test-functional"

programming_language: Markdown