CVE-2007-6738: pyftpdlib Use of Insufficiently Random Values of port selection on PASV command

May 1, 2022 (updated October 21, 2024)

pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command, which makes it easier for remote attackers to obtain potentially sensitive information about the number of in-progress data connections by reading the response to this command.

References

github.com/advisories/GHSA-gh7c-cg3x-pmcr
github.com/giampaolo/pyftpdlib
github.com/giampaolo/pyftpdlib/commit/d171bdc4ef7ac769671946a8a3e5eaafc39a9202
github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-22.yaml
nvd.nist.gov/vuln/detail/CVE-2007-6738

Code Behaviors & Features

Detect and mitigate CVE-2007-6738 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →