Memory Leak Vulnerability in python-pyftpdlib Package
Summary
DEBIAN-CVE-2009-5013: Memory leak in the on_dtp_close function in ftpserver.py in pyftpdlib before 0.5.2 allows remote authenticated users to cause a denial of service (memory consumption) by sending a QUIT command during a data transfer. Affects python-pyftpdlib versions < 0.5.2-1. Fixed in 0.5.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-pyftpdlib package is a popular FTP server library for Python, designed to provide a robust and flexible framework for building FTP servers. It supports various features such as passive and active modes, authentication, and file transfer capabilities. However, prior to version 0.5.2, the package contained a memory leak vulnerability that could be exploited by remote authenticated users, leading to potential denial of service.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2009-5013, originates from a memory leak in the on_dtp_close function within the ftpserver.py file of the pyftpdlib package. This flaw allows remote authenticated users to cause excessive memory consumption by sending a QUIT command during an active data transfer. The ramifications of this vulnerability include service disruption and degraded performance of the FTP server, which could affect all users relying on the service.
How To Fix
Minimum fixed version
0.5.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-pyftpdlibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the FTP server by implementing stricter authentication measures or limiting the number of concurrent connections. This may help mitigate the risk of exploitation until the package can be updated.
Conclusion
In summary, the memory leak vulnerability in the python-pyftpdlib package poses a significant risk to FTP server operations. It is crucial to update to the latest patched version to safeguard against potential denial of service attacks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-pyftpdlib →
FAQ
The vulnerability is a memory leak that can be exploited by remote authenticated users, potentially leading to denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability may result in service disruptions and degraded performance for users of the FTP server.
Yes, a patch is available in version 0.5.2-1 of the python-pyftpdlib package.
If immediate updates are not possible, consider implementing stricter access controls and monitoring for unusual activity on your FTP server.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-pyftpdlib.
