GitHub Advisoryadvisory · PyPI

GHSA-8wxf-c45w-g66g rdiffweb vulnerable to password complexity bypass leading to weak passwords

MEDIUM Published 2022-09-30 Modified 2024-10-26 Official page ↗
Aliases
CVE-2022-3326
Ecosystem
PyPI
Packages
rdiffweb
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-521
Reviewed
2022-10-01

Affected packages

• PyPI rdiffweb: < 2.4.9 → fixed in 2.4.9

Description

ikus060/rdiffweb prior to 2.4.9 allows a user to set there password to all spaces. While rdiffweb has a password policy requiring passwords to be between 8 and 128 characters, it does not validate the password entropy, allowing users to bypass password complexity requirements with weak passwords. This issue has been fixed in version 2.4.9. No workarounds are known to exist.

Related

Alias · CVE (1)

  • CVE-2022-3326 Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9. vulnerability

Weakness · CWE (1)

  • CWE-521 Weak Password Requirements weakness

References