GHSA-hrj7-f62f-j7x7HighCVSS 7.5

rdiffweb allows unlimited length of root directory name, which could result in DoS

Published
September 27, 2022
Last Modified
October 25, 2024

🔗 CVE IDs covered (1)

CVE-2022-3295 →

📋 Description

rdiffweb prior to 2.4.8 has no limit in length of root directory names. Allowing users to enter long strings may result in a DOS attack or memory corruption. Version 2.4.8 defines a field limit for username, email, and root directory.

🎯 Affected products1

  • pip/rdiffweb:>= 0, < 2.4.8

🔗 References (5)