Description
Denial of service (DoS) vulnerability in Nicotine+ 3.0.3 and later allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nicotine-plus | >= 3.0.3, < 3.2.1 | 3.2.1 | GHSA-p4v2-r99v-wjc2 |
References
- https://github.com/nicotine-plus/nicotine-plus/issues/1777
- FEDORA-2022-066232000e vendor-advisory
- GLSA-202210-20 vendor-advisory