CVE-2008-7264: Improper input validation in pyftpdlib
Summary
CVE-2008-7264: Improper input validation in pyftpdlib. Affects pyftpdlib versions < 0.5.0. Fixed in 0.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyftpdlib is a Python FTP server library that provides a high-level interface for implementing FTP servers. It allows developers to create custom FTP servers with ease. The library is widely used in various Python projects and provides essential functionality for handling FTP connections and file transfers. However, a vulnerability has been discovered in pyftpdlib versions prior to 0.5.0.
Vulnerability Detail
The vulnerability, identified as CVE-2008-7264, is due to improper input validation in the ftp_QUIT function of pyftpdlib's ftpserver.py module. Remote authenticated users can exploit this vulnerability by sending a QUIT command during a disallowed data-transfer attempt. This can lead to a denial of service (DoS) attack, causing file descriptor exhaustion and potentially resulting in a daemon outage. The severity of this vulnerability is rated as MODERATE with a CVSS score of 4.3.
How To Fix
Minimum fixed version
0.5.0
This is the first release that contains the fix.
pip install --upgrade "pyftpdlib==0.5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of pyftpdlib.
Conclusion
In conclusion, the vulnerability in pyftpdlib versions prior to 0.5.0 allows remote authenticated users to cause a denial of service attack. To mitigate this vulnerability, it is crucial to upgrade to pyftpdlib version 0.5.0 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyftpdlib →
FAQ
pyftpdlib is a Python FTP server library that allows developers to create custom FTP servers.
The vulnerability can be exploited by remote authenticated users to cause a denial of service (DoS) attack, potentially leading to a daemon outage.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 4.3.
To fix this vulnerability, upgrade to pyftpdlib version 0.5.0 or later.
There is no specific workaround mentioned for this vulnerability. Upgrading to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for pyftpdlib.
