~ / search / GHSA-3fhq-72hw-jqwv

GHSA-3fhq-72hw-jqwv

rdiffweb's lack of token name length limit can result in DoS or memory corruption

Source: GitHub Advisory Database (reviewed) High CVE-2022-3371

Packages

EcosystemPackageAffectedFixed in
PyPI rdiffweb < 2.5.0a3 2.5.0a3

Details

As written in the advisory (Markdown source, shown as plain text).

rdiffweb prior to 2.5.0a3 is vulnerable to Allocation of Resources Without Limits or Throttling. A lack of limit in the length of the `Token name` parameter can result in denial of service or memory corruption. Version 2.5.0a3 fixes this issue.

References

External links from the advisory. They lead to third-party sites.