GHSA-7fqm-jm52-f9vc

rdiffweb vulnerable to Use of Cache Containing Sensitive Information

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-3292

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	rdiffweb	< 2.4.9	2.4.9

Details

As written in the advisory (Markdown source, shown as plain text).

rdiffweb prior to version 2.4.9 is vulnerable to Use of Cache Containing Sensitive Information. Due to improper cache control, an attacker can view sensitive information even if they are not logged into an account. Version 2.4.9 contains a patch for this issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-3292 advisory
https://github.com/ikus060/rdiffweb/commit/2406780831618405a13113377a784f3102465f40 web
https://github.com/ikus060/rdiffweb package
https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-296.yaml web
https://huntr.dev/bounties/e9309018-e94f-4e15-b7d1-5d38b6021c5d web