medium6.3
CVE-2009-5011
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in pyftpdlib
Impact
Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the getpeername function having an ENOTCONN error, a different vulnerability than CVE-2010-3494.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | pyftpdlib | <= 0.5.1 | 0.5.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| G.Rodola | Pyftpdlib | through 0.5.1 Versions 0.1, 0.1.1, 0.2.0, 0.3.0, 0.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://code.google.com/p/pyftpdlib/issues/detail?id=100
- http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY
- http://code.google.com/p/pyftpdlib/source/detail?r=543
- http://code.google.com/p/pyftpdlib/source/diff?spec=svn543&r=543&format=side&path=/trunk/pyftpdlib/ftpserver.py
- https://github.com/advisories/GHSA-62xg-239j-vxg7
- https://nvd.nist.gov/vuln/detail/CVE-2009-5011
- https://github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-8.yaml