GitHub Advisoryadvisory · PyPI

GHSA-hw4g-fhcp-x5mq Concurrent Execution using Shared Resource with Improper Synchronization in pyftpdlib

HIGH Published 2022-05-17 Modified 2024-10-21 Official page ↗
Aliases
CVE-2010-3494
Ecosystem
PyPI
Packages
pyftpdlib
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-362
Reviewed
2022-07-08

Affected packages

• PyPI pyftpdlib: < 0.5.2 → fixed in 0.5.2

Description

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.

Related

Alias · CVE (1)

  • CVE-2010-3494 Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service… vulnerability

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References