GitHub Advisoryadvisory · PyPI

GHSA-qrj3-hrgj-fm7r rdiffweb's unlimited length email field can lead to DoS

HIGH Published 2022-09-27 Modified 2025-05-21 Official page ↗
Aliases
CVE-2022-3272
Ecosystem
PyPI
Packages
rdiffweb
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-130
Reviewed
2022-09-30

Affected packages

• PyPI rdiffweb: < 2.4.8 → fixed in 2.4.8

Description

rdiffweb prior to 2.4.8 does not validate email length, allowing users to insert an email longer than 255 characters. If a user signs up with an email with a length of 1 million or more characters and logs in, withdraws, or changes their email, the server may cause denial of service due to overload. Version 2.4.8 sets length limits for username, email, and root directory.

Related

Alias · CVE (1)

  • CVE-2022-3272 Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8. vulnerability

Weakness · CWE (1)

  • CWE-130 Improper Handling of Length Parameter Inconsistency weakness

References