Junglewise Threat Intelligence

CVE-2022-3290: rdiffweb Denial of Service via unlimited username length

CVE-2022-3290 · Severity: high · CVSS 7.5 · Published 2022-09-27

Technologies: rdiffweb (PyPI). Vendors: PyPI.

Executive brief

rdiffweb, a web interface for rdiff-backup repositories, is vulnerable to a denial-of-service attack. An attacker can submit an excessively long username during login or registration, which can crash the service or make it unresponsive by consuming all available memory. This prevents legitimate users from accessing their backups and managing their data.

Technical details

rdiffweb prior to version 2.4.8 fails to validate the length of the 'username' input field. This vulnerability (CWE-130) allows a remote, unauthenticated attacker to send a specially crafted request containing an extremely large username string. Processing this request can lead to excessive memory consumption or memory corruption, resulting in a Denial of Service (DoS) condition. The issue is resolved in version 2.4.8 by implementing field limits for usernames, emails, and root directory paths.

Affected products

  • ikus060 rdiffweb < 2.4.8

Timeline

  • 2022-09-26: advisory: NVD published CVE-2022-3290
  • 2022-09-27: disclosed: GitHub Advisory published
  • 2022-09-27: patched: Version 2.4.8 released

References

Related threats