Denial of Service Vulnerability in python-pyftpdlib: Race Condition in FTPHandler
Summary
CVE-2009-5011: Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading... Affects python-pyftpdlib versions < 0.5.2-1. Fixed in 0.5.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-pyftpdlib is a popular FTP server library for Python, providing a robust framework for implementing FTP servers. It is widely used due to its ease of integration and flexibility. However, prior to version 0.5.2, the library contained a race condition in the FTPHandler class, which could be exploited by remote attackers to cause a denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2009-5011, arises from a race condition in the FTPHandler class within ftpserver.py of pyftpdlib before version 0.5.2. This issue allows remote attackers to establish a TCP connection and then immediately close it, leading to an ENOTCONN error in the getpeername function. The result is a denial of service, causing the FTP daemon to become unresponsive. This vulnerability is distinct from CVE-2010-3494, highlighting the need for specific attention to this issue.
How To Fix
Minimum fixed version
0.5.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-pyftpdlibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing connection throttling or rate limiting on your FTP server to mitigate the impact of this vulnerability. This can help reduce the likelihood of an attacker successfully exploiting the race condition.
Conclusion
The CVE-2009-5011 vulnerability in python-pyftpdlib poses a significant risk of denial of service due to a race condition in the FTPHandler class. Users are strongly advised to upgrade to the latest version to mitigate this risk. For those unable to upgrade immediately, implementing workarounds such as connection throttling can help reduce exposure.
See every vulnerability recorded for python-pyftpdlib →
FAQ
CVE-2009-5011 is a vulnerability in the python-pyftpdlib library that allows remote attackers to cause a denial of service by exploiting a race condition in the FTPHandler class.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary consequence is a denial of service, where the FTP server may become unresponsive, impacting users and services that rely on it.
Yes, upgrading to python-pyftpdlib version 0.5.2-1 or later will patch this vulnerability.
A race condition occurs when the behavior of software depends on the sequence or timing of uncontrollable events, which can lead to unexpected behavior or vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for python-pyftpdlib.
