—

PYSEC-2010-22

Quick fix

PYSEC-2010-22 — pyftpdlib: upgrade to the fixed version with the command below.

pip install --upgrade 'pyftpdlib>=0.1.1'

Details

pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command, which makes it easier for remote attackers to obtain potentially sensitive information about the number of in-progress data connections by reading the response to this command.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/pyftpdlib

Introduced in: 0Fixed in: 0.1.1

Fixpip install --upgrade 'pyftpdlib>=0.1.1'

References

http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY[WEB]
https://github.com/advisories/GHSA-gh7c-cg3x-pmcr[ADVISORY]