CVE-2022-3326: Weak Password Requirements in ikus060/rdiffweb
First published: Wed Sep 28 2022(Updated: )
ikus060/rdiffweb prior to 2.4.9 allows a user to set there password to all spaces. While rdiffweb has a password policy requiring passwords to be between 8 and 128 characters, it does not validate the password entropy, allowing users to bypass password complexity requirements with weak passwords. This issue has been fixed in version 2.4.9. No workarounds are known to exist.
Credit: security@huntr.dev security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ikus-soft Rdiffweb | <2.4.9 | |
| pip/rdiffweb | <2.4.9 | 2.4.9 |
| <2.4.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/ikus060/rdiffweb/commit/ee98e5af78ec60db8a17fef6ea0ca250e3f31eec
- https://huntr.dev/bounties/1f6a5e49-23f2-45f7-8661-19f9cee8ae97
- https://nvd.nist.gov/vuln/detail/CVE-2022-3326
- https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-297.yaml
- https://github.com/advisories/GHSA-8wxf-c45w-g66g (Advisory)
Frequently Asked Questions
What is CVE-2022-3326?
CVE-2022-3326 is a vulnerability in the GitHub repository ikus060/rdiffweb prior to version 2.4.9 that allows weak password requirements.
What is the severity of CVE-2022-3326?
The severity of CVE-2022-3326 is medium with a CVSS score of 4.3.
How does CVE-2022-3326 affect the ikus060/rdiffweb repository?
CVE-2022-3326 affects the ikus060/rdiffweb repository prior to version 2.4.9 by allowing weak password requirements.
How can I fix CVE-2022-3326?
To fix CVE-2022-3326, it is recommended to update the ikus060/rdiffweb repository to version 2.4.9 or later.
Are there any references related to CVE-2022-3326?
Yes, here are some references related to CVE-2022-3326: - GitHub commit: [link](https://github.com/ikus060/rdiffweb/commit/ee98e5af78ec60db8a17fef6ea0ca250e3f31eec) - huntr.dev bounty details: [link](https://huntr.dev/bounties/1f6a5e49-23f2-45f7-8661-19f9cee8ae97)
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/weakness
- agent/title
- agent/severity
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-8wxf-c45w-g66g
- alias/CVE-2022-3326
- agent/software-canonical-lookup
- agent/references
- agent/description
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/tags
- agent/trending
- vendor/ikus-soft
- canonical/ikus-soft rdiffweb
- package-manager/pip