CVE-2015-8748: Radicale regex metacharacters injection in the user name
(updated )
Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by .*.
References
- github.com/Kozea/Radicale
- github.com/Kozea/Radicale/commit/1109973a925970353dfd13c6df8de0e4e446d983
- github.com/Kozea/Radicale/pull/341
- github.com/Unrud/Radicale/commit/4bfe7c9f7991d534c8b9fbe153af9d341f925f98
- github.com/advisories/GHSA-6w8c-6jrg-qwj2
- github.com/pypa/advisory-database/tree/main/vulns/radicale/PYSEC-2016-37.yaml
- nvd.nist.gov/vuln/detail/CVE-2015-8748
- pypi.org/project/radicale
- web.archive.org/web/20200804235922/http://www.securityfocus.com/bid/80255
Code Behaviors & Features
Detect and mitigate CVE-2015-8748 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →