CVE-2022-3376 (Python, published 2022-10-06T18:16Z)
Description: value: Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
Repository: https://github.com/ikus060/rdiffweb
Files changed:
README.md
rdiffweb/controller/page_pref_general.py
rdiffweb/controller/tests/test_page_prefs_general.py
Commit message: Enforce password policy new password cannot be set as new password


Vulnerable code:
            flash(_("Wrong current password."), level='warning')
        else:
            # Clear number of attempts
            if CHANGE_PASSWORD_ATTEMPTS in cherrypy.session:
                del cherrypy.session[CHANGE_PASSWORD_ATTEMPTS]
            # If Valid, update password
            try:
                user.set_password(self.new.data)
                flash(_("Password updated successfully."), level='success')
            except ValueError as e:
                flash(str(e), level='warning')
                password_form.populate_obj(self.app.currentuser)
        self.assertStatus(200)
        self.assertStatus(200)
        self.assertStatus(200)
        self.assertStatus(200)

Fixed code:
* Enforce password policy new password cannot be set as new password [CVE-2022-3376](https://nvd.nist.gov/vuln/detail/CVE-2022-3376)
    def validate_new(self, field):
        """
        Make sure new password if not equals to old password.
        """
        if self.new.data and self.new.data == self.current.data:
            raise ValueError(_('The new password must be different from the current password.'))

            self.current.errors = [_("Wrong current password.")]
            return False

        # Clear number of attempts
        if CHANGE_PASSWORD_ATTEMPTS in cherrypy.session:
            del cherrypy.session[CHANGE_PASSWORD_ATTEMPTS]

        try:
            user.set_password(self.new.data)
            return True
        except ValueError as e:
            self.new.errors = [str(e)]
            return False
                raise cherrypy.HTTPRedirect("")
                if password_form.populate_obj(self.app.currentuser):
                    flash(_("Password updated successfully."), level='success')
                    raise cherrypy.HTTPRedirect("")
        self.assertStatus(303)
        self.getPage(self.PREFS)
            self.assertStatus(303)
            self.getPage(self.PREFS)
            self.assertStatus(200)
        self.assertStatus(303)
        self.getPage(self.PREFS)
            self.assertStatus(303)
            self.getPage(self.PREFS)
            self.assertStatus(200)
        # Then user is redirect to same page
        self.assertStatus(303)
        # Then the page return success message.
        self.getPage(self.PREFS)
    def test_change_password_with_same_value(self):
        # Given a user with a password
        self._set_password(self.PASSWORD, "pr3j5Dwi", "pr3j5Dwi")
        self.assertStatus(303)
        # When updating the pasword with the same password
        self._set_password("pr3j5Dwi", "pr3j5Dwi", "pr3j5Dwi")
        self.assertStatus(200)
        # Then an error should be displayed
        self.assertInBody("The new password must be different from the current password.")