GHSA-hrj7-f62f-j7x7

rdiffweb allows unlimited length of root directory name, which could result in DoS

Source: GitHub Advisory Database (reviewed) High CVE-2022-3295

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	rdiffweb	< 2.4.8	2.4.8

Details

As written in the advisory (Markdown source, shown as plain text).

rdiffweb prior to 2.4.8 has no limit in length of root directory names. Allowing users to enter long strings may result in a DOS attack or memory corruption. Version 2.4.8 defines a field limit for username, email, and root directory.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-3295 advisory
https://github.com/ikus060/rdiffweb/commit/667657c6fe2b336c90be37f37fb92f65df4feee3 web
https://github.com/ikus060/rdiffweb package
https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-293.yaml web
https://huntr.dev/bounties/202dd03a-3d97-4c64-bc73-1a0f36614233 web