Lucene search

GitHub Advisory DatabaseGHSA-HRJ7-F62F-J7X7

HistorySep 27, 2022 - 12:00 a.m.

rdiffweb allows unlimited length of root directory name, which could result in DoS

2022-09-2700:00:22

CWE-770

GitHub Advisory Database

github.com

rdiffweb

root directory name

dos attack

memory corruption

version 2.4.8

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

37.9%

JSON

rdiffweb prior to 2.4.8 has no limit in length of root directory names. Allowing users to enter long strings may result in a DOS attack or memory corruption. Version 2.4.8 defines a field limit for username, email, and root directory.

Affected configurations

Vulners

Node

rdiffwebrdiffwebRange0–2.4.8

VendorProductVersionCPE
rdiffwebrdiffweb*cpe:2.3:a:rdiffweb:rdiffweb:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rdiffweb	rdiffweb	*	cpe:2.3:a:rdiffweb:rdiffweb::::::::

References

github.com/advisories/GHSA-hrj7-f62f-j7x7

github.com/ikus060/rdiffweb/commit/667657c6fe2b336c90be37f37fb92f65df4feee3

github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-293.yaml

huntr.dev/bounties/202dd03a-3d97-4c64-bc73-1a0f36614233

nvd.nist.gov/vuln/detail/CVE-2022-3295

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

37.9%

JSON

Related for GHSA-HRJ7-F62F-J7X7