CyberSec.Space Logo
Back to CVE Browser

CVE-2020-9274

HIGH
7.5
CVSS Severity Score
EPSS Score0.0960%
EPSS Percentile10.23th
PublishedFeb 26, 2020
Last ModifiedNov 21, 2024

Vulnerability Description

An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called, they fail to correctly detect the end of the linked list and try to access a non-existent list member. This is related to init_aliases in diraliases.c.

Affected Platforms (CPE)

📦
Pureftpd

Pure Ftpd

< 1.0.50
💻
Debian

Debian Linux

= 8.0
📦
Fedoraproject

Extra Packages For Enterprise Linux

= 7.0
📦
Fedoraproject

Extra Packages For Enterprise Linux

= 8.0
💻
Fedoraproject

Fedora

= 30
💻
Fedoraproject

Fedora

= 31
💻
Fedoraproject

Fedora

= 32
💻
Canonical

Ubuntu Linux

= 16.04

References & Advisories

🔗 https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa
🔗 https://lists.debian.org/debian-lts-announce/2020/02/msg00029.html
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22P44PECZWNDP7CMBL7NRBMNFS73C5Z2/
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5NSUDWXZVWUCL6R2PTX3KBB42Z62CA5/
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5DBVHJCXWRSJPNJQCJQCKZF6ZDPZCKA/
🔗 https://security.gentoo.org/glsa/202003-54
🔗 https://usn.ubuntu.com/4515-1/
🔗 https://www.pureftpd.org/project/pure-ftpd/news/

Related Vulnerabilities

CVE-2017-121709.8

Downstream version 1.0.46-1 of pure-ftpd as shipped in Fedora was vulnerable to packaging error due to which the original configur...

CVE-2020-93657.5

An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function in utils.c.

CVE-2020-353597.5

Pure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection li...

CVE-2019-201767.5

In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c.