GitHub Advisoryadvisory · PyPI

GHSA-3fhq-72hw-jqwv rdiffweb's lack of token name length limit can result in DoS or memory corruption

HIGH Published 2022-10-01 Modified 2024-10-25 Official page ↗
Aliases
CVE-2022-3371
Ecosystem
PyPI
Packages
rdiffweb
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2022-10-03

Affected packages

• PyPI rdiffweb: < 2.5.0a3 → fixed in 2.5.0a3

Description

rdiffweb prior to 2.5.0a3 is vulnerable to Allocation of Resources Without Limits or Throttling. A lack of limit in the length of the `Token name` parameter can result in denial of service or memory corruption. Version 2.5.0a3 fixes this issue.

Related

Alias · CVE (1)

  • CVE-2022-3371 Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References