CVE-2022-3251 (published 2022-09-21T17:15Z)

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-311
cwe_name: Missing Encryption of Sensitive Data
description: The product does not encrypt sensitive or critical information before storage or transmission.
extended_description: The lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys.
         

Fix information:
repo_url: https://github.com/ikus060/minarca
commit_details: repo_url: https://github.com/ikus060/minarca
author: Patrik Dufresne
author_date: 2022-09-16 16:34:51-04:00
msg: Upgrade rdiffweb to 2.4.5 to vix vulnerabilities
repository: repo_url: https://github.com/ikus060/minarca
repo_name: ikus060/minarca
description: Self-hosted opensource software to backup all your data on Linux, Windows and Mac
repo_language: Python
owner: ikus060
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -69,7 +69,20 @@ The Minarca website is https://www.ikus-soft.com/en/minarca/.
 
 # Changelog
 
-## Next Release
+## 4.2.2 (2022-09-16)
+
+This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.
+
+* Upgrade Rdiffweb to 2.4.5
+  * Mitigate CSRF on repository deletion and user deletion. [CVE-2022-3232](https://nvd.nist.gov/vuln/detail/CVE-2022-3232)
+  * Use `X-Real-IP` to identify client IP address to mitigate Brute-Force attack
+  * Mitigate CSRF in profile's SSH Keys [CVE-2022-3221](https://nvd.nist.gov/vuln/detail/CVE-2022-3221)
+  * Use 'Secure' Attribute with Sensitive Cookie in HTTPS Session. [CVE-2022-3174](https://nvd.nist.gov/vuln/detail/CVE-2022-3174)
+  * Avoid leakage of the stack trace in the default error page. [CVE-2022-3175](https://nvd.nist.gov/vuln/detail/CVE-2022-3175)
+  * Enforce minimum and maximum password length [CVE-2022-3175](https://nvd.nist.gov/vuln/detail/CVE-2022-3179)
+  * Add Clickjacking Defense [CVE-2022-3167](https://nvd.nist.gov/vuln/detail/CVE-2022-3167)
+
+## 4.2.1 (2022-07-15)
 
 * Add Ubuntu Jammy support
 * Add Debian Bookworm support

programming_language: Markdown
filename: test_minarca.py
change_type: ModificationType.MODIFY
diff: @@ -50,7 +50,7 @@ class MinarcaPluginTest(minarca_server.tests.AbstractMinarcaTest):
         # Given a minarca base dir
         self.assertIsNotNone(self.app.cfg.minarca_user_base_dir)
         # When adding a new user without specific user_root
-        self._add_user("mtest1", None, "mtest1", None, False)
+        self._add_user("mtest1", None, "password", None, False)
         self.assertInBody("User added successfully.")
         # Then user root directory is defined within the base dir
         user = self.app.store.get_user('mtest1')
@@ -60,7 +60,7 @@ class MinarcaPluginTest(minarca_server.tests.AbstractMinarcaTest):
         # Given a minarca base dir
         self.assertIsNotNone(self.app.cfg.minarca_user_base_dir)
         # When adding a new user with a specific user_root
-        self._add_user("mtest2", None, "mtest2", "/home/mtest2", False)
+        self._add_user("mtest2", None, "password", "/home/mtest2", False)
         self.assertInBody("User added successfully.")
         # Then user root is updated to be within the base dir
         user = self.app.store.get_user('mtest2')

programming_language: Python
filename: setup.py
change_type: ModificationType.MODIFY
diff: @@ -27,7 +27,7 @@ setuptools.setup(
         "setuptools_scm>=5.0.1",
     ],
     install_requires=[
-        "rdiffweb==2.4.0",
+        "rdiffweb==2.4.5",
         "cherrypy>=18.0.0",
         "requests",
         "tzlocal~=2.0",

programming_language: Python