PT-2010-1236 · None · Pyftpdlib

Publicado 2010-10-19 · Atualizado 2022-05-01 · CVE-2007-6738

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pyftpdlib versions prior to 0.1.1

Description The issue allows remote attackers to obtain potentially sensitive information about the number of in-progress data connections by reading the response to the PASV command. This is because the software does not choose a random value for the port associated with the PASV command.

Recommendations For versions prior to 0.1.1, update to version 0.1.1 or later to resolve the issue.

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-330

Identificadores relacionados

CVE-2007-6738

GHSA-GH7C-CG3X-PMCR

PYSEC-2010-22

Produtos afetados

Pyftpdlib

Referências · 7

• https://github.com/giampaolo/pyftpdlib · Nota
• https://github.com/giampaolo/pyftpdlib/commit/d171bdc4ef7ac769671946a8a3e5eaafc39a9202 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-22.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6738 · Nota de Segurança
• http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY · Nota
• https://osv.dev/vulnerability/GHSA-gh7c-cg3x-pmcr · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2010-22 · Aviso do Fabricante