freewvs's nested directory structure can interrupt scan

低 3.3CVE-2020-15101 · GHSA-7pmh-vrww-25xx · PYSEC-2020-233 · 14/07/2020 公開 · 17/06/2026 更新

要点

CVE-2020-15101 は freewvs, freewvs (schokokeks) に影響する深刻度「低」 (CVSS 3.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.69%（全脆弱性の 53.1% より高い）。
対処：0.1.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
freewvs PyPI	`< 0.1.1`	`0.1.1`
freewvs schokokeks	`< 0.1.1`	`0.1.1`

概要

Impact

A directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk(). This can be problematic in a case where an administrator scans the dirs of potentially untrusted users.

Patches

This has been fixed in this commit by limiting the recursion to 500 directories: https://github.com/schokokeksorg/freewvs/commit/83a6b55c0435c69f447488b791555e6078803143

This issue was discovered by Hanno Böck.

NVD の説明

In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk(). This can be problematic in a case where an administrator scans the dirs of potentially untrusted users. This has been patched in 0.1.1.