GHSA-mp5p-g2jv-r8qw

rdiffweb contains Weak Password Requirements

Source: GitHub Advisory Database (reviewed) High CVE-2022-3179

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	rdiffweb	>= 2.4.1, < 2.4.2	2.4.2

Details

As written in the advisory (Markdown source, shown as plain text).

rdiffweb version 2.4.1 has no password policy or password checking, which could make users vulnerable to brute force password guessing attacks. Version 2.4.2 enforces minimum and maximum password lengths.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-3179 advisory
https://github.com/ikus060/rdiffweb/commit/233befc33bdc45d4838c773d5aed4408720504c5 web
https://github.com/advisories/GHSA-mp5p-g2jv-r8qw advisory
https://github.com/ikus060/rdiffweb package
https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-272.yaml web
https://huntr.dev/bounties/58eae29e-3619-449d-9bba-fdcbabcba5fe web