Описание
The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.
Ссылки
- Third Party Advisory
- PatchVendor Advisory
- Mailing ListThird Party Advisory
- Mailing ListVendor Advisory
- Third Party Advisory
- PatchVendor Advisory
- Mailing ListThird Party Advisory
- Mailing ListVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.2 (исключая)
cpe:2.3:a:gnu:inetutils:*:*:*:*:*:*:*:*
Конфигурация 2
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
EPSS
Процентиль: 50%
0.00271
Низкий
6.5 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-345
Связанные уязвимости
CVSS3: 6.5
ubuntu
больше 4 лет назад
The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.
CVSS3: 6.5
debian
больше 4 лет назад
The ftp client in GNU Inetutils before 2.2 does not validate addresses ...
CVSS3: 6.5
github
больше 3 лет назад
The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.
EPSS
Процентиль: 50%
0.00271
Низкий
6.5 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-345