Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xNncyLWp4Y20tMmNyas4AAgH6

Improper Authentication in pyftpdlib

ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.

Permalink: https://github.com/advisories/GHSA-q6w2-jxcm-2crj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xNncyLWp4Y20tMmNyas4AAgH6
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago

CVSS Score: 7.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Identifiers: GHSA-q6w2-jxcm-2crj, CVE-2008-7263
References:

• https://nvd.nist.gov/vuln/detail/CVE-2008-7263
• https://github.com/giampaolo/pyftpdlib/issues/73
• https://github.com/advisories/GHSA-q6w2-jxcm-2crj
• https://github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-5.yaml
• http://code.google.com/p/pyftpdlib/issues/detail?id=73
• http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY
• http://code.google.com/p/pyftpdlib/source/detail?r=348
• http://code.google.com/p/pyftpdlib/source/diff?spec=svn348&r=348&format=side&path=/trunk/pyftpdlib/ftpserver.py

Repository: https://github.com/giampaolo/pyftpdlib
Blast Radius: 18.3

Affected Packages