GitHub Advisoryadvisory · PyPI

GHSA-wjjc-m3fc-fcm8 MoinMoin Denial of Service vulnerability via password_checker function

HIGH Published 2022-05-17 Modified 2024-11-26 Official page ↗
Aliases
CVE-2008-6549
Ecosystem
PyPI
Packages
moin
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2024-02-09

Affected packages

• PyPI moin: < 1.6.1 → fixed in 1.6.1

Description

The password_checker function in `config/multiconfig.py` in MoinMoin prior to version 1.6.1 uses the cracklib and python-crack features even though they are not thread-safe, which allows remote attackers to cause a denial of service (segmentation fault and crash) via unknown vectors.

Related

Alias · CVE (1)

  • CVE-2008-6549 The password_checker function in config/multiconfig.py in MoinMoin 1.6.1 uses the cracklib and python-crack features even though they are… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References