GHSA-qq29-5vjh-vxwr

rdiffweb vulnerable to Improper Cleanup on Thrown Exception

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-3301

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	rdiffweb	< 2.4.8	2.4.8

Details

As written in the advisory (Markdown source, shown as plain text).

rdiffweb prior to version 2.4.8 is vulnerable to Improper Cleanup on Thrown Exception. This could allow an attacker to display a message of their choice onto a web page. Version 2.4.8 contains a fix for this issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-3301 advisory
https://github.com/ikus060/rdiffweb/commit/5ac38b2a75becbab9f948bd5e37ecbcd9f0b362e web
https://github.com/ikus060/rdiffweb package
https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-295.yaml web
https://huntr.dev/bounties/d3bf1e5d-055a-44b8-8d60-54ab966ed63a web