starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-24043 (published 2024-03-19T07:15Z)

Directory Traversal vulnerability in Speedy11CZ MCRPX v.1.4.0 and before allows a local attacker to execute arbitrary code via a crafted file.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Speedy11CZ/mcrpx
commit_details: repo_url: https://github.com/Speedy11CZ/mcrpx
author: Speedy11CZ
author_date: 2024-01-15 10:06:53+01:00
msg: Hotfix for path traversal vulnerability
repository: repo_url: https://github.com/Speedy11CZ/mcrpx
repo_name: Speedy11CZ/mcrpx
description: MCRPX is a tool to extract files from Minecraft: Java Edition resource packs into selected directory. It can also bypass corrupted resource packs, used by servers to protect their resource packs.
repo_language: Java
owner: Speedy11CZ
file_changes: filename: ZipUtil.java
change_type: ModificationType.MODIFY
diff: @@ -99,6 +99,11 @@ public class ZipUtil {
             int elementCount = 0;
             while (zipEntries.hasMoreElements()) {
                 ZipEntry zipEntry = zipEntries.nextElement();
+                if (zipEntry.getName().contains("..")) {
+                    listener.onMessage("Skipping " + zipEntry.getName() + ": Invalid path");
+                    continue;
+                }
+
                 try {
                     listener.onMessage("Extracting " + zipEntry.getName());
                     try (InputStream entryInputStream = zipFile.getInputStream(zipEntry)) {
@@ -141,6 +146,11 @@ public class ZipUtil {
             int elementCount = 0;
             while (jarEntries.hasMoreElements()) {
                 JarEntry jarEntry = jarEntries.nextElement();
+                if (jarEntry.getName().contains("..")) {
+                    listener.onMessage("Skipping " + jarEntry.getName() + ": Invalid path");
+                    continue;
+                }
+
                 if (jarEntry.getName().startsWith("assets/") && !jarEntry.isDirectory()) {
                     listener.onMessage("Extracting " + jarEntry.getName());
                     try (InputStream entryInputStream = jarFile.getInputStream(jarEntry)) {

programming_language: Java
filename: gradle.properties
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 # Project properties
-projectDescription=Core library for plugins used by ketchup plugins, developed by Rajce.pro.
-projectVersion=1.4.0
+projectDescription=MCRPX is a tool to extract files from Minecraft: Java Edition resource packs into selected directory. It can also bypass corrupted resource packs, used by servers to protect their resource packs.
+projectVersion=1.4.1
 # Gradle properties
 org.gradle.daemon=true
 org.gradle.configureondemand=true

programming_language: Markdown
CVE-2012-2319 (published 2012-05-17T11:00Z)

Multiple buffer overflows in the hfsplus filesystem implementation in the Linux kernel before 3.3.5 allow local users to gain privileges via a crafted HFS plus filesystem, a related issue to CVE-2009-4020.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Greg Kroah-Hartman
author_date: 2012-05-04 12:09:39-07:00
msg: hfsplus: Fix potential buffer overflows

Commit ec81aecb2966 ("hfs: fix a potential buffer overflow") fixed a few
potential buffer overflows in the hfs filesystem.  But as Timo Warns
pointed out, these changes also need to be made on the hfsplus
filesystem as well.

Reported-by: Timo Warns <warns@pre-sense.de>
Acked-by: WANG Cong <amwang@redhat.com>
Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: Miklos Szeredi <mszeredi@suse.cz>
Cc: Sage Weil <sage@newdream.net>
Cc: Eugene Teo <eteo@redhat.com>
Cc: Roman Zippel <zippel@linux-m68k.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Dave Anderson <anderson@redhat.com>
Cc: stable <stable@vger.kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: catalog.c
change_type: ModificationType.MODIFY
diff: @@ -366,6 +366,10 @@ int hfsplus_rename_cat(u32 cnid,
 	err = hfs_brec_find(&src_fd);
 	if (err)
 		goto out;
+	if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
+		err = -EIO;
+		goto out;
+	}
 
 	hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
 				src_fd.entrylength);

programming_language: C
filename: dir.c
change_type: ModificationType.MODIFY
diff: @@ -150,6 +150,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
 		filp->f_pos++;
 		/* fall through */
 	case 1:
+		if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+			err = -EIO;
+			goto out;
+		}
+
 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
 			fd.entrylength);
 		if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) {
@@ -181,6 +186,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
 			err = -EIO;
 			goto out;
 		}
+
+		if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+			err = -EIO;
+			goto out;
+		}
+
 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
 			fd.entrylength);
 		type = be16_to_cpu(entry.type);

programming_language: C
CVE-2023-46237 (published 2023-10-31T15:15Z)

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/FOGProject/fogproject
commit_details: repo_url: https://github.com/FOGProject/fogproject
author: Corban Amouzou
author_date: 2023-01-28 17:32:41-08:00
msg: Add authentication check in getfiles to prevent file enumeration, thanks to @0x41c
repository: repo_url: https://github.com/FOGProject/fogproject
repo_name: FOGProject/fogproject
description: An open source computer cloning & management system
repo_language: PHP
owner: FOGProject
file_changes: filename: getfiles.php
change_type: ModificationType.MODIFY
diff: @@ -22,6 +22,16 @@
  * @link     https://fogproject.org
  */
 require '../commons/base.inc.php';
+
+// Prevent file enumeration by an unauthenticated user
+$unauthorized = !$currentUser->isValid() || empty($_SERVER['HTTP_X_REQUESTED_WITH'])
+    || strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) !== 'xmlhttprequest';
+
+if ($unauthorized) {
+    echo _('Unauthorized');
+    exit;
+}
+
 if (!is_string($_GET['path'])) {
     echo json_encode(
         _('Invalid')

programming_language: PHP
CVE-2022-21723 (published 2022-01-27T00:15Z)

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/pjsip/pjproject
commit_details: repo_url: https://github.com/pjsip/pjproject
author: sauwming
author_date: 2022-01-26 13:28:57+08:00
msg: Merge pull request from GHSA-7fw8-54cv-r7pm
repository: repo_url: https://github.com/pjsip/pjproject
repo_name: pjsip/pjproject
description: PJSIP project
repo_language: C
owner: pjsip
file_changes: filename: scanner.c
change_type: ModificationType.MODIFY
diff: @@ -444,16 +444,21 @@ PJ_DEF(void) pj_scan_get_n( pj_scanner *scanner,
 
 PJ_DEF(int) pj_scan_get_char( pj_scanner *scanner )
 {
-    int chr = *scanner->curptr;
+    register char *s = scanner->curptr;
+    int chr;
 
-    if (!chr) {
+    if (s >= scanner->end || !*s) {
 	pj_scan_syntax_err(scanner);
 	return 0;
     }
 
-    ++scanner->curptr;
+    chr = *s;
 
-    if (PJ_SCAN_IS_PROBABLY_SPACE(*scanner->curptr) && scanner->skip_ws) {
+    ++s;
+    scanner->curptr = s;
+    if (PJ_SCAN_CHECK_EOF(s) && PJ_SCAN_IS_PROBABLY_SPACE(*s) &&
+    	scanner->skip_ws)
+    {
 	pj_scan_skip_whitespace(scanner);
     }
     return chr;

programming_language: C
CVE-2017-16803 (published 2017-11-13T17:29Z)

In Libav through 11.11 and 12.x through 12.1, the smacker_decode_tree function in libavcodec/smacker.c does not properly restrict tree recursion, which allows remote attackers to cause a denial of service (bitstream.c:build_table() out-of-bounds read and application crash) via a crafted Smacker stream.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/libav/libav
commit_details: repo_url: https://github.com/libav/libav
author: Michael Niedermayer
author_date: 2012-06-21 16:01:52+02:00
msg: smacker: add sanity check for length in smacker_decode_tree()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Bug-Id: 1098
Cc: libav-stable@libav.org
Signed-off-by: Sean McGovern <gseanmcg@gmail.com>
repository: repo_url: https://github.com/libav/libav
repo_name: libav/libav
description: Libav github mirror, clone of git://git.libav.org/libav
repo_language: C
owner: libav
file_changes: filename: smacker.c
change_type: ModificationType.MODIFY
diff: @@ -43,7 +43,7 @@
 
 #define SMKTREE_BITS 9
 #define SMK_NODE 0x80000000
-
+#define SMKTREE_DECODE_MAX_RECURSION 32
 
 typedef struct SmackVContext {
     AVCodecContext *avctx;
@@ -97,6 +97,11 @@ enum SmkBlockTypes {
 static int smacker_decode_tree(BitstreamContext *bc, HuffContext *hc,
                                uint32_t prefix, int length)
 {
+    if (length > SMKTREE_DECODE_MAX_RECURSION) {
+        av_log(NULL, AV_LOG_ERROR, "Maximum tree recursion level exceeded.\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     if (!bitstream_read_bit(bc)) { // Leaf
         if(hc->current >= 256){
             av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n");

programming_language: C
CVE-2019-14463 (published 2019-07-31T23:15Z)

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/stephane/libmodbus
commit_details: repo_url: https://github.com/stephane/libmodbus
author: Stéphane Raimbault
author_date: 2019-07-26 16:00:06+02:00
msg: Fix VD-1301 and VD-1302 vulnerabilities

This patch was contributed by Maor Vermucht and Or Peles from
VDOO Connected Trust.
repository: repo_url: https://github.com/stephane/libmodbus
repo_name: stephane/libmodbus
description: A Modbus library for Linux, Mac OS, FreeBSD and Windows
repo_language: C
owner: stephane
file_changes: filename: modbus.c
change_type: ModificationType.MODIFY
diff: @@ -839,9 +839,10 @@ int modbus_reply(modbus_t *ctx, const uint8_t *req,
         break;
     case MODBUS_FC_WRITE_MULTIPLE_COILS: {
         int nb = (req[offset + 3] << 8) + req[offset + 4];
+        int nb_bits = req[offset + 5];
         int mapping_address = address - mb_mapping->start_bits;
 
-        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb) {
+        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb || nb_bits * 8 < nb) {
             /* May be the indication has been truncated on reading because of
              * invalid address (eg. nb is 0 but the request contains values to
              * write) so it's necessary to flush. */
@@ -870,9 +871,10 @@ int modbus_reply(modbus_t *ctx, const uint8_t *req,
         break;
     case MODBUS_FC_WRITE_MULTIPLE_REGISTERS: {
         int nb = (req[offset + 3] << 8) + req[offset + 4];
+        int nb_bytes = req[offset + 5];
         int mapping_address = address - mb_mapping->start_registers;
 
-        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb) {
+        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb || nb_bytes * 8 < nb) {
             rsp_length = response_exception(
                 ctx, &sft, MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE, rsp, TRUE,
                 "Illegal number of values %d in write_registers (max %d)\n",

programming_language: C
CVE-2014-8176 (published 2015-06-12T19:59Z)

The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/openssl/openssl
commit_details: repo_url: https://github.com/openssl/openssl
author: zhu qun-ying
author_date: 2014-06-02 14:38:52+01:00
msg: Free up s->d1->buffered_app_data.q properly.

PR#3286
repository: repo_url: https://github.com/openssl/openssl
repo_name: openssl/openssl
description: TLS/SSL and crypto library
repo_language: C
owner: openssl
file_changes: filename: d1_lib.c
change_type: ModificationType.MODIFY
diff: @@ -202,9 +202,12 @@ static void dtls1_clear_queues(SSL *s)
 
 	while ( (item = pqueue_pop(s->d1->buffered_app_data.q)) != NULL)
 		{
-		frag = (hm_fragment *)item->data;
-		OPENSSL_free(frag->fragment);
-		OPENSSL_free(frag);
+		rdata = (DTLS1_RECORD_DATA *) item->data;
+		if (rdata->rbuf.buf)
+			{
+			OPENSSL_free(rdata->rbuf.buf);
+			}
+		OPENSSL_free(item->data);
 		pitem_free(item);
 		}
 	}

programming_language: C
CVE-2024-29904 (published 2024-03-29T16:15Z)

CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server. Upgrade to v4.4.7 or later. \n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/codeigniter4/CodeIgniter4
commit_details: repo_url: https://github.com/codeigniter4/CodeIgniter4
author: kenjis
author_date: 2024-03-29 11:34:46+09:00
msg: Merge pull request from GHSA-39fp-mqmm-gxj6

fix: Language, Router, and Filters
repository: repo_url: https://github.com/codeigniter4/CodeIgniter4
repo_name: codeigniter4/CodeIgniter4
description: Open Source PHP Framework (originally from EllisLab)
repo_language: PHP
owner: codeigniter4
CVE-2022-36088 (published 2022-09-07T23:15Z)

GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local access to the server GoCD Server or Agent are installed on to modify executables or components of the installation. This does not affect zip file-based installs, installations to other platforms, or installations inside `Program Files` or `Program Files (x86)`. This issue is fixed in GoCD 22.2.0 installers. As a workaround, if the server or agent is installed outside of `Program Files (x86)`, verify the the permission of the Server or Agent installation directory to ensure the `Everyone` user group does not have `Full Control`, `Modify` or `Write` permissions.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/gocd/gocd
commit_details: repo_url: https://github.com/gocd/gocd
author: Chad Wilson
author_date: 2022-05-17 19:06:29+08:00
msg: Add NSIS AccessControl plugin to set permissions on install dir

From https://nsis.sourceforge.io/AccessControl_plug-in adding ANSI version (i386) since that's we are using for now.
repository: repo_url: https://github.com/gocd/gocd
repo_name: gocd/gocd
description: GoCD - Continuous Delivery server main repository
repo_language: Java
owner: gocd
file_changes: filename: go-base.nsi
change_type: ModificationType.MODIFY
diff: @@ -152,6 +152,21 @@ Function ".onInit"
   ${LogSet} off
 FunctionEnd
 
+Function "SetupDirectoryPermissions"
+    ${LogText} "Setting directory permissions..."
+
+	; Disable inheritance. This breaks the inheritance chain and turns inherited permissions into explicit ones.
+	AccessControl::DisableFileInheritance $INSTDIR
+	; Make Administrators the owner
+	AccessControl::SetFileOwner $INSTDIR "(S-1-5-32-544)"
+	; Clear all explicit permissions on the file, leaving Administrators with full access
+	AccessControl::ClearOnFile  $INSTDIR "(S-1-5-32-544)" "FullAccess"
+	; Give SYSTEM full access.
+	AccessControl::SetOnFile    $INSTDIR "(S-1-5-18)"     "FullAccess"
+	; Give Everyone only access to read, list dir, and execute.
+	AccessControl::SetOnFile    $INSTDIR "(S-1-1-0)"      "GenericRead + GenericExecute + ListDirectory + ReadAttributes"
+FunctionEnd
+
 ; This section (being the first one, not because it's called Install) will be executed after the `.onInit` callback
 Section "Install"
   SectionIn RO
@@ -160,6 +175,8 @@ Section "Install"
   SetOutPath $INSTDIR
   ${LogSet} on
 
+  Call SetupDirectoryPermissions
+
   ${If} $IsUpgrading == "true"
     ${LogText} "Performing an upgrade"
     Call BeforeUpgrade

programming_language: PowerShell
CVE-2024-21671 (published 2024-01-30T16:15Z)

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).  It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks.  Version 4.2.0 patches this vulnerability.

CVSS v3 base score: 3.7, LOW (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-203
cwe_name: Observable Discrepancy
description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
extended_description: Discrepancies can take many forms, and variations may be detectable in timing, control flow, communications such as replies or requests, or general behavior. These discrepancies can reveal information about the product's operation or internal state to an unauthorized actor. In some cases, discrepancies can be used by attackers to form a side channel.
         

Fix information:
repo_url: https://github.com/vantage6/vantage6
commit_details: repo_url: https://github.com/vantage6/vantage6
author: Bart van Beusekom
author_date: 2024-01-18 09:36:11+01:00
msg: Merge pull request from GHSA-45gq-q4xh-cp53

Fix for username timing attack
repository: repo_url: https://github.com/vantage6/vantage6
repo_name: vantage6/vantage6
description: The main vantage6 repository: code for the central server, nodes, CLI and Python Client
repo_language: Python
owner: vantage6