Is CVE-2022-3371 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-3371 being exploited in the wild.

How severe is CVE-2022-3371?

Low severity, with a CVSS score of 3.1, published 30 September 2022.

Which products and versions are affected?

rdiffweb (PyPI) ECOSYSTEM:introduced=0,fixed=2.5.0a3, GIT:introduced=0,fixed=b62c479ff6979563c7c23e7182942bc4f460a2c7|ECOSYSTEM:introduced=0,fixed=2.4.10.

Is there a fix for CVE-2022-3371?

Yes. rdiffweb (PyPI): upgrade to 2.4.10, 2.5.0a3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-3371 attacked?

It is attacked over the network.

Am I affected by CVE-2022-3371?

Check whether you run rdiffweb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-3371: PYSEC-2022-299 - Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.

CVE-2022-3371 · Severity: low · CVSS 3.1 · Published 2022-09-30

rdiffweb is a web-based backup client and server used to manage incremental file backups. Due to a lack of length validation on token names, an attacker can submit an extremely long token name that causes the application to allocate excessive memory, resulting in denial of service or memory corruption that crashes the service.

Technologies: rdiffweb (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-3371 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-3371 being exploited in the wild.
How severe is CVE-2022-3371?: Low severity, with a CVSS score of 3.1, published 30 September 2022.
Which products and versions are affected?: rdiffweb (PyPI) ECOSYSTEM:introduced=0,fixed=2.5.0a3, GIT:introduced=0,fixed=b62c479ff6979563c7c23e7182942bc4f460a2c7|ECOSYSTEM:introduced=0,fixed=2.4.10.
Is there a fix for CVE-2022-3371?: Yes. rdiffweb (PyPI): upgrade to 2.4.10, 2.5.0a3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-3371 attacked?: It is attacked over the network.
Am I affected by CVE-2022-3371?: Check whether you run rdiffweb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rdiffweb (PyPI): upgrade to 2.4.10, 2.5.0a3 or later
```
pip install "rdiffweb>=2.5.0a3"
```

Technical details

rdiffweb prior to version 2.5.0a3 contains an Allocation of Resources Without Limits or Throttling vulnerability (CWE-770) in its token name parameter. The application fails to enforce a maximum length limit on the token name field, allowing an attacker to send a request with an excessively long token name. This causes uncontrolled memory allocation, leading to denial of service or potential memory corruption. The vulnerability requires network access but no authentication, allowing unauthenticated remote attackers to trigger the issue. The fix limits the length of token name and fullname fields, mitigating resource exhaustion.

Affected products

rdiffweb rdiffweb before 2.5.0a3

Identifiers

CVE-2022-3371
GHSA-3fhq-72hw-jqwv
PYSEC-2022-299

Timeline

2022-10-01: disclosed
2022-10-01: patched: Version 2.5.0a3 fixes the issue

References

https://github.com/ikus060/rdiffweb/commit/b62c479ff6979563c7c23e7182942bc4f460a2c7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.