Описание
basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.
A flaw was found in basic-ftp, an FTP client for Node.js. A malicious or compromised FTP server can exploit this vulnerability by sending an unterminated multiline response during the initial FTP banner phase, before authentication. The client continuously appends attacker-controlled data and repeatedly reparses the accumulated buffer without enforcing a maximum size. This can lead to a client-side Denial of Service (DoS), causing the application to become unresponsive, consume excessive memory and CPU, and potentially result in process termination or service degradation.
Меры по смягчению последствий
To mitigate this issue, restrict applications using the basic-ftp client to connect only to trusted FTP servers. Implement firewall rules or network access controls to limit outbound connections from affected systems to known, legitimate FTP endpoints. This operational control reduces the exposure to malicious or compromised FTP servers that could exploit this vulnerability. A restart of the affected application may be required for changes to take effect.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Developer Hub | rhdh/rhdh-hub-rhel9 | Will not fix | ||
| Red Hat Enterprise Linux 10 | rust | Not affected | ||
| Red Hat Enterprise Linux 9 | rust | Not affected | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rust | Affected | ||
| Red Hat Hardened Images | rust | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-agent-installer-ui-rhel9 | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-console-rhel9 | Not affected | ||
| Self-service automation portal 2 | ansible-automation-platform/automation-portal | Not affected | ||
| Self-service automation portal 2 | ansible-automation-platform/bootc-automation-portal-rhel9 | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.
basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.
basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is v ...
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
EPSS
7.5 High
CVSS3