—

PYSEC-2010-9

Quick fix

PYSEC-2010-9 — pyftpdlib: upgrade to the fixed version with the command below.

pip install --upgrade 'pyftpdlib>=0.5.2'

Details

ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/pyftpdlib

Introduced in: 0Fixed in: 0.5.2

Fixpip install --upgrade 'pyftpdlib>=0.5.2'

References

http://code.google.com/p/pyftpdlib/source/diff?spec=svn596&r=596&format=side&path=/trunk/pyftpdlib/ftpserver.py[WEB]
http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY[WEB]
http://code.google.com/p/pyftpdlib/source/detail?r=596[WEB]
http://code.google.com/p/pyftpdlib/issues/detail?id=114[WEB]
https://github.com/advisories/GHSA-h4g7-8m7r-87r9[ADVISORY]