CVE-2021-45848: Denial of Service Vulnerability in Nicotine+
Summary
CVE-2021-45848: Nicotine+ DoS on Null Character in Download Request. Affects nicotine-plus versions >= 3.0.3, < 3.2.1. Fixed in 3.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nicotine+ is an open-source Python package available on PyPI. It is a Soulseek client that allows users to connect to the Soulseek peer-to-peer file-sharing network. Nicotine+ provides a user-friendly interface for searching and downloading files from the network. However, versions 3.0.3 to 3.2.0 of Nicotine+ are vulnerable to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability in Nicotine+ allows a user with a modified Soulseek client to crash the application by sending a file download request with a file path containing a null character. This improper encoding or escaping of output can lead to a DoS condition, causing the application to become unresponsive or crash. The impact of this vulnerability can disrupt the availability of the Nicotine+ application for legitimate users.
How To Fix
Minimum fixed version
3.2.1
This is the first release that contains the fix.
pip install --upgrade "nicotine-plus==3.2.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of Nicotine+ as soon as possible.
Conclusion
The vulnerability in Nicotine+ allows an attacker to crash the application by sending a file download request with a null character in the file path. To mitigate this vulnerability, users should update to Nicotine+ version 3.2.1 or later. There are no known workarounds for this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nicotine-plus →
FAQ
The vulnerability allows an attacker to crash the Nicotine+ application, causing a denial of service (DoS) condition. This can disrupt the availability of the application for legitimate users.
You can use the Vulert Playground at Vulert Scanner to check if your version of Nicotine+ is affected by this vulnerability. Simply enter your Pipfile.lock and the playground will provide real-time alerts for open-source vulnerabilities.
Yes, the fix for this vulnerability is included in Nicotine+ version 3.2.1. It is recommended to update to this version or later to mitigate the risk.
No, there are no known workarounds for this vulnerability. Updating to the latest version of Nicotine+ is the recommended solution.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-p4v2-r99v-wjc2/GHSA-p4v2-r99v-wjc2.json
