GitHub Advisoryadvisory · PyPI

GHSA-mp5p-g2jv-r8qw rdiffweb contains Weak Password Requirements

HIGH Published 2022-09-14 Modified 2024-10-25 Official page ↗
Aliases
CVE-2022-3179
Ecosystem
PyPI
Packages
rdiffweb
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-521
Reviewed
2022-09-15

Affected packages

• PyPI rdiffweb: >= 2.4.1, < 2.4.2 → fixed in 2.4.2

Description

rdiffweb version 2.4.1 has no password policy or password checking, which could make users vulnerable to brute force password guessing attacks. Version 2.4.2 enforces minimum and maximum password lengths.

Related

Alias · CVE (1)

  • CVE-2022-3179 Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2. vulnerability

Weakness · CWE (1)

  • CWE-521 Weak Password Requirements weakness

References