PT-2022-21826 · Rdiffweb · Rdiffweb

Published 2022-09-30 · Updated 2022-10-04 · CVE-2022-3371

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.5.0a3

Description The issue is related to the allocation of resources without limits or throttling. A lack of limit in the length of the Token name parameter can result in denial of service or memory corruption.

Recommendations For versions prior to 2.5.0a3, update to version 2.5.0a3 to resolve the issue. As a temporary workaround, consider restricting the length of the Token name parameter to prevent potential denial of service or memory corruption.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2022-3371

GHSA-3FHQ-72HW-JQWV

PYSEC-2022-299

Affected Products

Rdiffweb

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3371.json · Exploit
• 🔥 https://huntr.dev/bounties/4e8f6136-50c7-4fa1-ac98-699bcb7b35ce · Exploit
• https://github.com/ikus060/rdiffweb/commit/b62c479ff6979563c7c23e7182942bc4f460a2c7 · Patch
• https://osv.dev/vulnerability/CVE-2022-3371 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3fhq-72hw-jqwv · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3371 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-299.yaml · Note
• https://github.com/ikus060/rdiffweb · Note
• https://t.me/cibsecurity/50770 · Telegram Post