GHSA-7942-2fx8-qhpf

Raneto v0.17.0 employs weak password complexity requirements

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-35143

Packages

Ecosystem	Package	Affected	Fixed in
npm	raneto	< 0.17.1	0.17.1

Details

As written in the advisory (Markdown source, shown as plain text).

Raneto v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks. Version 0.17.1 contains security mitigations for this and other vulnerabilities.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-35143 advisory
https://github.com/ryanlelek/Raneto/pull/370 web
https://github.com/ryanlelek/Raneto/commit/55e442c9bc67b845094e14ceb228e95c639595be web
https://cwe.mitre.org/data/definitions/521.html web
https://gainsec.com/2022/08/04/cve-2022-35142-cve-2022-35143-cve-2022-35144 web
https://github.com/gilbitron/Raneto/releases web
https://github.com/ryanlelek/Raneto package
https://github.com/ryanlelek/Raneto/releases/tag/0.17.1 web
http://raneto.com web