CVE-2008-6549: MoinMoin Denial of Service vulnerability via password_checker function
Summary
CVE-2008-6549: MoinMoin Denial of Service vulnerability via password_checker function. Affects moin versions < 1.6.1. Fixed in 1.6.1. How to fix ↓
Also tracked for
- moin · Debian:10
The same CVE-2008-6549 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing. The password_checker function in the config/multiconfig.py file of MoinMoin versions prior to 1.6.1 utilizes the cracklib and python-crack features, which are not thread-safe. This vulnerability allows remote attackers to exploit the application and cause a denial of service (DoS) by triggering a segmentation fault and crashing the system.
Vulnerability Detail
The password_checker function in MoinMoin prior to version 1.6.1 uses the cracklib and python-crack features even though they are not thread-safe. This allows remote attackers to cause a denial of service (segmentation fault and crash) via unknown vectors. The vulnerability arises from the lack of proper handling of thread safety in the password_checker function, which can be exploited by malicious actors to disrupt the normal functioning of the application.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.1
This is the first release that contains the fix.
pip install --upgrade "moin==1.6.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to MoinMoin version 1.6.1 or later.
Conclusion
The MoinMoin Denial of Service vulnerability via the password_checker function can be exploited by remote attackers to cause a crash and disrupt the normal functioning of the system. To mitigate this risk, it is crucial to upgrade to MoinMoin version 1.6.1 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
The vulnerability allows remote attackers to cause a denial of service (DoS) by crashing the MoinMoin system. This can lead to service disruption and potential data loss.
You can use the Vulert Playground at Vulert Scanner to check if your MoinMoin installation is affected by this vulnerability. Simply provide your Pipfile.lock and the playground will analyze it for any open-source vulnerabilities, including this one.
Yes, the fix for this vulnerability is available in MoinMoin version 1.6.1 or later. It is recommended to upgrade your installation to the latest version to mitigate the risk.
There are no known public exploits specifically targeting this vulnerability at the time of this report. However, it is crucial to apply the fix promptly to prevent any potential exploitation.
You can find more information about this vulnerability in the CVE-2008-6549 entry or the MoinMoin project's advisory on GitHub: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-wjjc-m3fc-fcm8/GHSA-wjjc-m3fc-fcm8.json
Related vulnerabilities
Recent vulnerabilities recorded for moin.
