CVE-2020-15101: freewvs's nested directory structure can interrupt scan
2.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.39512%
CWE
Published
8/30/2024
Updated
8/30/2024
KEV Status
No
Technology
Python
Technical Details
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
freewvs | pip | >= 0, < 0.1.1 | 0.1.1 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from the use of os.walk()
in the main directory scanning loop without recursion depth control. Python's os.walk()
uses recursion internally, and the original implementation allowed unlimited directory nesting. When scanning a directory with >1000 nested subdirectories, this would hit Python's recursion limit, crashing the scan. The commit fixed this by adding a check on root.count(os.sep)
to limit recursion depth. The vulnerable code is explicitly shown in the diff as the unmodified os.walk()
loop in the 'freewvs' file's main scanning logic.