Sign in
Deutsch English Español Polski
High

MoinMoin Denial of Service vulnerability via password_checker function

  • Disclosed: 30.03.2009
  • Updated: 11.10.2026 12:18

The password_checker function in config/multiconfig.py in MoinMoin prior to version 1.6.1 uses the cracklib and python-crack features even though they are not thread-safe, which allows remote attackers to cause a denial of service (segmentation fault and crash) via unknown vectors.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) moin < 1.6.1 1.6.1

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-400
Platform
Python (PyPI)
Package
moin
Disclosed
30.03.2009
Updated
11.10.2026 12:18

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2009-12 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-wjjc-m3fc-fcm8 - CC BY 4.0

Vulnerability history: moin

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (41) in the archive
Total entries
41
First → latest
04.2008 05.2022
Without a fix
5
Exploited in attacks
0

Severity breakdown

  • High 11
  • Medium 30

Disclosures per year

earlier: 23

Severity:
  1. MoinMoin Improper Privilege Management
    High CVE-2004-1463 < 1.2.3 1.2.3
  2. MoinMoin Improper Access Control
    High CVE-2004-1462 < 1.2.3 1.2.3
  3. MoinMoin allows administrative access
    High CVE-2004-0708 < 1.2.2 1.2.2
  4. MoinMoin vulnerable to remote code execution via cache action
    High · 8.8 CVE-2020-25074 < 1.9.11 1.9.11
  5. MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended ac
    High · 7.5 CVE-2009-4762 >= 1.7, < 1.7.3, >= 1.8, < 1.8.3 1.7.3, 1.8.3
  6. MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.
    High CVE-2010-0669 < 1.8.7, >= 1.9, < 1.9.2 1.8.7, 1.9.2
  7. The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.
    High CVE-2010-0717 < 1.8.7 1.8.7
  8. MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain se
    High · 7.5 CVE-2010-0667 >= 1.9, < 1.9.1 1.9.1
  9. MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability tha
    High · 7.5 CVE-2008-6603 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1
  10. MoinMoin Denial of Service vulnerability via password_checker function this entry
    High · 7.5 CVE-2008-6549 < 1.6.1 1.6.1
  11. The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.
    High · 7.5 CVE-2008-1937 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.