VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Feb 3, 2016· Updated May 6, 2026

CVE-2015-8748

CVE-2015-8748

Description

Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by ".*".

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
RadicalePyPI
< 1.11.1

Affected products

1

Patches

2
1109973a9259

Merge pull request #341 from Unrud/patch-4

https://github.com/Kozea/RadicaleGuillaume AyoubDec 23, 2015via ghsa
commit
1 file changed · +4 −1
  • radicale/rights/regex.py+4 −1 modified
    @@ -65,7 +65,10 @@ def _read_from_sections(user, collection_url, permission):
     """Get regex sections."""
     filename = os.path.expanduser(config.get("rights", "file"))
     rights_type = config.get("rights", "type").lower()
-    regex = ConfigParser({"login": user, "path": collection_url})
+    # Prevent "regex injection"
+    user_escaped = re.escape(user)
+    collection_url_escaped = re.escape(collection_url)
+    regex = ConfigParser({"login": user_escaped, "path": collection_url_escaped})
     if rights_type in DEFINED_RIGHTS:
         log.LOGGER.debug("Rights type '%s'" % rights_type)
         regex.readfp(StringIO(DEFINED_RIGHTS[rights_type]))
4bfe7c9f7991

Prevent "regex injection"

https://github.com/Unrud/RadicaleUnrudDec 23, 2015via ghsa
commit
1 file changed · +4 −1
  • radicale/rights/regex.py+4 −1 modified
    @@ -65,7 +65,10 @@ def _read_from_sections(user, collection_url, permission):
     """Get regex sections."""
     filename = os.path.expanduser(config.get("rights", "file"))
     rights_type = config.get("rights", "type").lower()
-    regex = ConfigParser({"login": user, "path": collection_url})
+    # Prevent "regex injection"
+    user_escaped = re.escape(user)
+    collection_url_escaped = re.escape(collection_url)
+    regex = ConfigParser({"login": user_escaped, "path": collection_url_escaped})
     if rights_type in DEFINED_RIGHTS:
         log.LOGGER.debug("Rights type '%s'" % rights_type)
         regex.readfp(StringIO(DEFINED_RIGHTS[rights_type]))

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

14

News mentions

0

No linked articles in our index yet.