Memory Leak Vulnerability in python-pyftpdlib: Denial of Service Risk
Summary
CVE-2009-5013: Memory leak in the on_dtp_close function in ftpserver.py in pyftpdlib before 0.5.2 allows remote authenticated users to cause a denial of service (memory consumption) by sending a QUIT command during a data transfer. Affects python-pyftpdlib versions < 0.5.2-1. Fixed in 0.5.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-pyftpdlib is a popular library for creating FTP servers in Python. It provides a robust framework for handling FTP connections, allowing developers to easily implement file transfer capabilities in their applications. However, prior to version 0.5.2, the library contained a vulnerability that could lead to memory leaks during data transfers, potentially affecting server performance and availability.
Vulnerability Detail
The vulnerability, identified as CVE-2009-5013, arises from a memory leak in the on_dtp_close function within ftpserver.py of pyftpdlib versions before 0.5.2. When a remote authenticated user sends a QUIT command during an active data transfer, the server fails to properly release memory resources, leading to increased memory consumption. This can result in a denial of service, as the server may become unresponsive due to exhausted memory resources.
How To Fix
Minimum fixed version
0.5.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-pyftpdlibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the number of simultaneous connections to your FTP server or monitor active sessions closely to prevent authenticated users from sending QUIT commands during data transfers. Additionally, consider implementing resource monitoring tools to alert you when memory usage approaches critical levels.
Conclusion
The memory leak vulnerability in python-pyftpdlib (CVE-2009-5013) poses a significant risk of denial of service due to excessive memory consumption during data transfers. Upgrading to the fixed version is essential for maintaining server stability and performance. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your applications.
See every vulnerability recorded for python-pyftpdlib →
FAQ
CVE-2009-5013 is a vulnerability in the python-pyftpdlib library that allows remote authenticated users to cause a denial of service by sending a QUIT command during a data transfer, leading to memory leaks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities without needing to install any software.
The primary consequence is a denial of service, where the FTP server may become unresponsive due to excessive memory consumption caused by the memory leak.
Yes, you should upgrade to version 0.5.2-1 or later of python-pyftpdlib to mitigate this vulnerability.
Yes, you can implement resource monitoring tools to keep track of memory usage and set alerts for unusual spikes that may indicate exploitation of this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for python-pyftpdlib.
