CVE-2022-3251: Missing Encryption of Sensitive Data (CWE-311)
value: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2.
CWE description: The product does not encrypt sensitive or critical information before storage or transmission.
CVSS v3 base score: 5.3
Published: 2022-09-21T17:15Z
Repository: https://github.com/ikus060/minarca
Language: Python
Files changed: README.md, minarca-server/minarca_server/plugins/tests/test_minarca.py, minarca-server/setup.py
Commit date: 2022-09-16 16:47:31 -0400
Commit message: Upgrade rdiffweb to 2.4.5 to vix vulnerabilities

Diff: diff --git a/README.md b/README.md
index 6804b4f..918baf9 100644
--- a/README.md
+++ b/README.md
@@ -67,11 +67,24 @@ and mirrored to [Github](https://github.com/ikus060/minarca).
 
 The Minarca website is https://www.ikus-soft.com/en/minarca/.
 
 # Changelog
 
-## Next Release
+## 4.2.2 (2022-09-16)
+
+This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.
+
+* Upgrade Rdiffweb to 2.4.5
+  * Mitigate CSRF on repository deletion and user deletion. [CVE-2022-3232](https://nvd.nist.gov/vuln/detail/CVE-2022-3232)
+  * Use `X-Real-IP` to identify client IP address to mitigate Brute-Force attack
+  * Mitigate CSRF in profile's SSH Keys [CVE-2022-3221](https://nvd.nist.gov/vuln/detail/CVE-2022-3221)
+  * Use 'Secure' Attribute with Sensitive Cookie in HTTPS Session. [CVE-2022-3174](https://nvd.nist.gov/vuln/detail/CVE-2022-3174)
+  * Avoid leakage of the stack trace in the default error page. [CVE-2022-3175](https://nvd.nist.gov/vuln/detail/CVE-2022-3175)
+  * Enforce minimum and maximum password length [CVE-2022-3175](https://nvd.nist.gov/vuln/detail/CVE-2022-3179)
+  * Add Clickjacking Defense [CVE-2022-3167](https://nvd.nist.gov/vuln/detail/CVE-2022-3167)
+
+## 4.2.1 (2022-07-15)
 
 * Add Ubuntu Jammy support
 * Add Debian Bookworm support
 * Adjust `librsync` dependencies for release upgrade
 * Remove dependencies to unmaintained `snakeoil` library
diff --git a/minarca-server/minarca_server/plugins/tests/test_minarca.py b/minarca-server/minarca_server/plugins/tests/test_minarca.py
index 3c063e2..7170c04 100644
--- a/minarca-server/minarca_server/plugins/tests/test_minarca.py
+++ b/minarca-server/minarca_server/plugins/tests/test_minarca.py
@@ -48,21 +48,21 @@ class MinarcaPluginTest(minarca_server.tests.AbstractMinarcaTest):
 
     def test_add_user_without_user_root(self):
         # Given a minarca base dir
         self.assertIsNotNone(self.app.cfg.minarca_user_base_dir)
         # When adding a new user without specific user_root
-        self._add_user("mtest1", None, "mtest1", None, False)
+        self._add_user("mtest1", None, "password", None, False)
         self.assertInBody("User added successfully.")
         # Then user root directory is defined within the base dir
         user = self.app.store.get_user('mtest1')
         self.assertEqual(os.path.join(self.base_dir, 'mtest1'), user.user_root)
 
     def test_add_user_with_user_root(self):
         # Given a minarca base dir
         self.assertIsNotNone(self.app.cfg.minarca_user_base_dir)
         # When adding a new user with a specific user_root
-        self._add_user("mtest2", None, "mtest2", "/home/mtest2", False)
+        self._add_user("mtest2", None, "password", "/home/mtest2", False)
         self.assertInBody("User added successfully.")
         # Then user root is updated to be within the base dir
         user = self.app.store.get_user('mtest2')
         self.assertEqual(os.path.join(self.base_dir, 'mtest2'), user.user_root)
 
diff --git a/minarca-server/setup.py b/minarca-server/setup.py
index 9f1fdc8..37e2517 100644
--- a/minarca-server/setup.py
+++ b/minarca-server/setup.py
@@ -25,11 +25,11 @@ setuptools.setup(
     packages=["minarca_server", "minarca_server.plugins", "minarca_server.core"],
     setup_requires=[
         "setuptools_scm>=5.0.1",
     ],
     install_requires=[
-        "rdiffweb==2.4.0",
+        "rdiffweb==2.4.5",
         "cherrypy>=18.0.0",
         "requests",
         "tzlocal~=2.0",
     ],
     # required packages for build process

Vulnerable code: ## Next Release
        self._add_user("mtest1", None, "mtest1", None, False)
        self._add_user("mtest2", None, "mtest2", "/home/mtest2", False)
        "rdiffweb==2.4.0",
Fixed code: ## 4.2.2 (2022-09-16)

This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.

* Upgrade Rdiffweb to 2.4.5
  * Mitigate CSRF on repository deletion and user deletion. [CVE-2022-3232](https://nvd.nist.gov/vuln/detail/CVE-2022-3232)
  * Use `X-Real-IP` to identify client IP address to mitigate Brute-Force attack
  * Mitigate CSRF in profile's SSH Keys [CVE-2022-3221](https://nvd.nist.gov/vuln/detail/CVE-2022-3221)
  * Use 'Secure' Attribute with Sensitive Cookie in HTTPS Session. [CVE-2022-3174](https://nvd.nist.gov/vuln/detail/CVE-2022-3174)
  * Avoid leakage of the stack trace in the default error page. [CVE-2022-3175](https://nvd.nist.gov/vuln/detail/CVE-2022-3175)
  * Enforce minimum and maximum password length [CVE-2022-3175](https://nvd.nist.gov/vuln/detail/CVE-2022-3179)
  * Add Clickjacking Defense [CVE-2022-3167](https://nvd.nist.gov/vuln/detail/CVE-2022-3167)

## 4.2.1 (2022-07-15)
        self._add_user("mtest1", None, "password", None, False)
        self._add_user("mtest2", None, "password", "/home/mtest2", False)
        "rdiffweb==2.4.5",