Red Hat Security AdvisoryRHSA-2020:1045
lftp security update
Released 2020-03-31 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) lftp-4.4.8-12.el7
- Red Hat Enterprise Linux Client Optional (v. 7) lftp-scripts-4.4.8-12.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) lftp-4.4.8-12.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) lftp-scripts-4.4.8-12.el7
- Red Hat Enterprise Linux Server (v. 7) lftp-4.4.8-12.el7, lftp-4.4.8-12.el7.ppc
- Red Hat Enterprise Linux Server Optional (v. 7) lftp-scripts-4.4.8-12.el7
- Red Hat Enterprise Linux Workstation (v. 7) lftp-4.4.8-12.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) lftp-scripts-4.4.8-12.el7
Fixes 1 record
Priority LOW 36
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.04782 · Published 2018-08-01 · Partial fix CWE-20
