PT-2022-21619 · Rdiffweb · Rdiffweb

Ikus060 · Published 2022-09-26 · Updated 2022-09-28 · CVE-2022-3298

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.4.8

Description The issue is related to the allocation of resources without limits or throttling, which can lead to a Denial of Service (DoS) attack. Specifically, an unlimited length "title" field when adding an SSH key can result in excess memory consumption. There are no known workarounds for this issue.

Recommendations For versions prior to 2.4.8, update to version 2.4.8 to resolve the issue. As a temporary workaround, consider restricting the length of the title field when adding an SSH key to minimize the risk of exploitation.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2022-3298

GHSA-XHW9-4WQQ-X67V

PYSEC-2022-294

Affected Products

Rdiffweb

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3298.json · Exploit
• 🔥 https://huntr.dev/bounties/f9fedf94-41c9-49c4-8552-e407123a44e7 · Exploit
• https://github.com/ikus060/rdiffweb/commit/626cca1b75b6c587afd4241a9692e8929b1921a5 · Patch
• https://osv.dev/vulnerability/GHSA-xhw9-4wqq-x67v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3298 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-294 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3298 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-294.yaml · Note
• https://github.com/ikus060/rdiffweb · Note
• https://t.me/cvenotify/36838 · Telegram Post
• https://t.me/cvenotify/36858 · Telegram Post
• https://t.me/cibsecurity/50526 · Telegram Post