CVE-2009-5013: Uncontrolled Resource Consumption in pyftpdlib
Summary
CVE-2009-5013: Uncontrolled Resource Consumption in pyftpdlib. Affects pyftpdlib versions < 0.5.2. Fixed in 0.5.2. How to fix ↓
Also tracked for
- python-pyftpdlib · Debian:11
The same CVE-2009-5013 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyftpdlib is a Python FTP server library that provides a high-level and convenient interface for implementing FTP servers. It allows developers to create custom FTP servers with ease. However, versions of pyftpdlib before 0.5.2 are vulnerable to a memory leak in the on_dtp_close function. This vulnerability can be exploited by remote authenticated users to cause a denial of service (memory consumption) by sending a QUIT command during a data transfer.
Vulnerability Detail
The vulnerability in pyftpdlib arises from a memory leak in the on_dtp_close function in ftpserver.py. When a remote authenticated user sends a QUIT command during a data transfer, it triggers the memory leak, leading to uncontrolled resource consumption. This can result in a denial of service condition where the server's memory is exhausted, causing it to become unresponsive or crash. The impact of this vulnerability can be severe, as it allows an attacker to disrupt the availability of the FTP server.
How To Fix
Minimum fixed version
0.5.2
This is the first release that contains the fix.
pip install --upgrade "pyftpdlib==0.5.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in pyftpdlib allows remote authenticated users to cause a denial of service by triggering a memory leak. To mitigate this vulnerability, it is crucial to upgrade to pyftpdlib version 0.5.2 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyftpdlib →
FAQ
pyftpdlib is a Python FTP server library that allows developers to create custom FTP servers.
The vulnerability allows remote authenticated users to cause a denial of service by consuming excessive server memory.
You can check the version of pyftpdlib installed on your system by running the following command:
pip show pyftpdlib
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the latest version of pyftpdlib.
You can find more information about this vulnerability in the GitHub Security Advisory GHSA-8gv6-x88p-3f6h.
Related vulnerabilities
Recent vulnerabilities recorded for pyftpdlib.
