PatchTheCVEpsftpd vulnerabilities and fixes
Recent CVEs affecting psftpd, with upgrade or downgrade steps. 4 tracked.
psftpd has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2017-11-15. Highest priority: CVE-2017-15271 (score 54/100).
- CVE-2017-15272 MEDIUM 5.3 DOWNGRADE The PSFTPd 10.0.4 Build 729 server stores its configuration inside PSFTPd.dat
- CVE-2017-15271 MEDIUM 5.9 DOWNGRADE A use-after-free issue could be triggered remotely in the SFTP component of PSFTPd 10.0.4 Build 729
- CVE-2017-15270 MEDIUM 5.3 DOWNGRADE The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Valu
- CVE-2017-15269 MEDIUM 4.3 DOWNGRADE The PSFTPd 10.0.4 Build 729 server does not prevent FTP bounce scans by default
FAQ
How do I fix psftpd vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is psftpd being exploited right now?
None of the tracked psftpd CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which psftpd CVE should I patch first?
CVE-2017-15271 currently ranks highest (54/100): A use-after-free issue could be triggered remotely in the SFTP component of PSFTPd 10.0.4 Build 729.