GHSA-mpg6-rgp4-35rr

Source

https://github.com/advisories/GHSA-mpg6-rgp4-35rr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-mpg6-rgp4-35rr/GHSA-mpg6-rgp4-35rr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mpg6-rgp4-35rr

Aliases

CVE-2009-5010
PYSEC-2010-7

Published

2022-05-02T04:00:27Z

Modified

2024-10-14T18:37:45Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in pyftpdlib

Details

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.1 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, a different vulnerability than CVE-2010-3494.

Database specific

{
    "cwe_ids": [
        "CWE-362"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-17T22:23:26Z",
    "nvd_published_at": "2010-10-19T20:00:00Z",
    "severity": "MODERATE"
}

References

Affected packages

PyPI / pyftpdlib

Package

Name: pyftpdlib; View open source insights on deps.dev
Purl: pkg:pypi/pyftpdlib

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.5.1

Affected versions

0.*

0.2.0

0.3.0

0.4.0

0.5.0

Database specific

last_known_affected_version_range

"<= 0.5.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-mpg6-rgp4-35rr/GHSA-mpg6-rgp4-35rr.json"