SUSE-SU-2022:1091-1 Security update for python

This update for python fixes the following issues: - CVE-2022-0391: Fixed URL sanitization containing ASCII newline and tabs in urlparse bsc1195396. - CVE-2021-4189: Fixed ftplib not to trust the PASV response bsc1194146. - CVE-2021-3572: Fixed an improper handling of unicode characters in pip...

Security update for python (moderate)

openSUSE Security Update: Security update for python Announcement ID: openSUSE-SU-2022:1091-1 Rating: moderate References: 1175619 1186819 1194146 1195396 Cross-References: CVE-2021-3572 CVE-2021-4189 CVE-2022-0391 CVSS scores: CVE-2021-3572 SUSE: 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N...

Denial Of Service (DoS)

python3 is vulnerable to denial of service. The vulnerability exists because the ftplib is using the host from the PASV response which allows an attacker to cause an application crash...

PSF-2021-5 ftplib should not use the host from the PASV response

The IPv4 address value returned from the server in response to the PASV command should not be trusted. This prevents a malicious FTP server from using the response to probe IPv4 address and port combinations on the client network. Instead of using the returned address, we use the IP address we're...

Pachev FTP Server 1.0 - Path Traversal

Pachev FTP Server 1.0 - Path Traversal Exploit Title: Pachev FTP Server 1.0 - Path Traversal Date: 2020-01-23 Vulnerability: Path Traversal Exploit Author: 1F98D Vendor Homepage: https://github.com/pachev/pachevftp from ftplib import FTP ip = rawinput"Target IP: " port = intrawinput"Target Port: ...

CVE-2013-1752

CVE-2013-1752 is a denial-of-service in Python readline usage within several network protocol modules (httplib, ftplib, imaplib, nntplib, poplib, smtplib). Remote attackers could exhaust memory via a long readline input. Connected advisories confirm fixes in various module releases: httplib fixed...

F5 Networks BIG-IP : Python and Jython vulnerability (K53192206)

REJECT Various versions of Python do not properly restrict readline calls, which allows remote attackers to cause a denial of service memory consumption via a long string, related to 1 httplib - fixed in 2.7.4, 2.6.9, and 3.3.3; 2 ftplib - fixed in 2.7.6, 2.6.9, 3.3.3; 3 imaplib - not yet fixed i...

Server Side Bruteforce Module: brut3k1t

Server Side Bruteforce Module brut3k1t is a server-side bruteforce module that supports dictionary attacks for several protocols. The current protocols that are complete and in support are: ssh ftp smtp XMPP instagram facebook There will be future implementations of different protocols and servic...

brut3k1t - Server-side Brute-force Module (ssh, ftp, smtp, facebook, and more)

Server-side brute-force module. Brute-force dictionary attack, jk attack that supports multiple protocols and services. 1. Introduction brut3k1t is a server-side bruteforce module that supports dictionary attacks for several protocols. The current protocols that are complete and in support are:...

freeFTPd 1.0.8 - 'mkd' Denial of Service

from ftplib import FTP print ''' ,;'++';, '++++++++++++++++; .+++++++++++++++++++++++' ;++++++: :++++++: '++++' , +. :; . .'++++; :++++, '+ +.+.++':+:+ +: + :++++, ++++, + ++.++':+.+ +:'.+. :++++ ,+++; + +:':++',++,++.+:+ +, '+++. '+++ ++ ;+ ,+:'; ,: ;;+++ +.++. +++; +++; : ++' + '+++ :++;++,+: +...

freeFTPd 1.0.8 - mkd Denial of Service

freeFTPd 1.0.8 - mkd Denial of Service from ftplib import FTP print ''' ,;'++';, '++++++++++++++++; .+++++++++++++++++++++++' ;++++++: :++++++: '++++' , +. :; . .'++++; :++++, '+ +.+.++':+:+ +: + :++++, ++++, + ++.++':+.+ +:'.+. :++++ ,+++; + +:':++',++,++.+:+ +, '+++. '+++ ++ ;+ ,+:'; ,: ;;+++...

SmallFTPd 1.0.3 - 'mkd' Denial of Service

from ftplib import FTP print ''' Created: ScrR1pTK1dd13 Name: Greg Priest Mail: [email protected] Exploit Title: smallftpmkdcommandDoSExploit Date: 2016.10.26 Exploit Author: Greg Priest Version: smallftpd 1.0.3 Tested on: Windows XP, Windows 7 x64 ''' ftpip = rawinput"FTP server IP...

SmallFTPd 1.0.3 - mkd Denial of Service

SmallFTPd 1.0.3 - mkd Denial of Service from ftplib import FTP print ''' Created: ScrR1pTK1dd13 Name: Greg Priest Mail: [email protected] Exploit Title: smallftpmkdcommandDoSExploit Date: 2016.10.26 Exploit Author: Greg Priest Version: smallftpd 1.0.3 Tested on: Windows XP, Windows ...

VMware ESXi Multiple Vulnerabilities (VMSA-2014-0012)

The remote VMware ESXi host is affected by multiple vulnerabilities : - Multiple denial of service vulnerabilities exist in Python function readstatus in library httplib and in function readline in libraries smtplib, ftplib, nntplib, imaplib, and poplib. A remote attacker can exploit these...

Fedora 20 : python-2.7.5-16.fc20 (2015-6010)

Security fix for CVE-2013-1752 multiple unbound readline DoS flaws in python stdlib following fixes which all relates to this CVE are in this patch : - ftplib: Limit amount of data read by limiting the call to readline. 16038 - imaplib: limit line length in imaplib readline calls. 16039 - nntplib...

CVE-2013-1752

Rejected reason: Various versions of Python do not properly restrict readline calls, which allows remote attackers to cause a denial of service memory consumption via a long string, related to 1 httplib - fixed in 2.7.4, 2.6.9, and 3.3.3; 2 ftplib - fixed in 2.7.6, 2.6.9, 3.3.3; 3 imaplib - not y...

PT-2013-3377

Name of the Vulnerable Software and Affected Versions Python versions prior to 2.6.9 Python versions prior to 2.7.4 Python versions prior to 2.7.6 Python versions prior to 3.3.3 Description The issue is related to various Python modules, including httplib, ftplib, imaplib, nntplib, poplib, and...

QFTP (LIBFtp 3.1-1) (command line) sprintf() local buffer overflow

http://nbpfaus.net/pfau/ftplib/ qftp is a utility that performs file transfers using ftplib based on instructions presented on the command line. Description buffer overflow in sprintf, setumask don't check sizelen of passed argument. Source error in main: 337: case 'm' : setumaskoptarg; break;...