GitHub Advisoryadvisory · PyPI

GHSA-p4v2-r99v-wjc2 Nicotine+ DoS on Null Character in Download Request

HIGH Published 2022-03-16 Modified 2023-09-05 Official page ↗
Aliases
CVE-2021-45848
Ecosystem
PyPI
Packages
nicotine-plus
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-116
Reviewed
2022-03-29

Affected packages

• PyPI nicotine-plus: >= 3.0.3, < 3.2.1 → fixed in 3.2.1

Description

Denial of service (DoS) vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.

Related

Alias · CVE (1)

  • CVE-2021-45848 Denial of service (DoS) vulnerability in Nicotine+ 3.0.3 and later allows a user with a modified Soulseek client to crash Nicotine+ by… vulnerability

Weakness · CWE (1)

  • CWE-116 Improper Encoding or Escaping of Output weakness

References