PT-2022-21561 · Rdiffweb · Rdiffweb

Published 2022-09-26 · Updated 2022-09-28 · CVE-2022-3290

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.4.8

Description The issue is related to improper handling of length parameter inconsistency. It can be exploited via an unlimited length username field, potentially leading to excess memory consumption or memory corruption, resulting in a Denial of Service (DoS).

Recommendations For versions prior to 2.4.8, update to version 2.4.8 to resolve the issue. As a temporary workaround, consider restricting the length of the username field to prevent potential exploitation.

Exploit

Fix

Weakness Enumeration

CWE-130

Related Identifiers

CVE-2022-3290

GHSA-5V95-J4RR-6F3C

PYSEC-2022-292

PYSEC-2022-43184

Affected Products

Rdiffweb

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3290.json · Exploit
• 🔥 https://huntr.dev/bounties/d8b8519d-96a5-484c-8141-624c54290bf5 · Exploit
• https://github.com/ikus060/rdiffweb/commit/667657c6fe2b336c90be37f37fb92f65df4feee3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3290 · Security Note
• https://osv.dev/vulnerability/GHSA-5v95-j4rr-6f3c · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-43184 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-292 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3290 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-43184.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-292.yaml · Note
• https://github.com/ikus060/rdiffweb · Note
• https://t.me/cibsecurity/50525 · Telegram Post