PT-2022-21604 · Rdiffweb · Rdiffweb

Published 2022-09-26 · Updated 2022-09-28 · CVE-2022-3295

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.4.8

Description The issue concerns the allocation of resources without limits or throttling, which can lead to a denial-of-service (DOS) attack or memory corruption. Specifically, there is no limit on the length of root directory names, allowing users to enter long strings. This can be exploited to cause a DOS attack or memory corruption.

Recommendations For versions prior to 2.4.8, update to version 2.4.8, which defines field limits for username, email, and root directory to prevent this issue.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2022-3295

GHSA-HRJ7-F62F-J7X7

PYSEC-2022-293

Affected Products

Rdiffweb

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3295.json · Exploit
• 🔥 https://huntr.dev/bounties/202dd03a-3d97-4c64-bc73-1a0f36614233 · Exploit
• https://github.com/ikus060/rdiffweb/commit/667657c6fe2b336c90be37f37fb92f65df4feee3 · Patch
• https://osv.dev/vulnerability/PYSEC-2022-293 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hrj7-f62f-j7x7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3295 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3295 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-293.yaml · Note
• https://github.com/ikus060/rdiffweb · Note