PT-2010-1236 · None · Pyftpdlib

Published 2010-10-19 · Updated 2022-05-01 · CVE-2007-6738

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pyftpdlib versions prior to 0.1.1

Description The issue allows remote attackers to obtain potentially sensitive information about the number of in-progress data connections by reading the response to the PASV command. This is because the software does not choose a random value for the port associated with the PASV command.

Recommendations For versions prior to 0.1.1, update to version 0.1.1 or later to resolve the issue.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2007-6738

GHSA-GH7C-CG3X-PMCR

PYSEC-2010-22

Affected Products

Pyftpdlib

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-6738 · Security Note
• https://osv.dev/vulnerability/GHSA-gh7c-cg3x-pmcr · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2010-22 · Vendor Advisory
• https://github.com/giampaolo/pyftpdlib · Note
• https://github.com/giampaolo/pyftpdlib/commit/d171bdc4ef7ac769671946a8a3e5eaafc39a9202 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-22.yaml · Note
• http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY · Note