CVE-2017-12170: Critical severity pureftpd Pure-FTPd vulnerability
Downstream version 1.0.46-1 of pure-ftpd as shipped in Fedora was vulnerable to packaging error due to which the original configuration was ignored after update and service started running with default configuration. This has security implications because of overriding security-related configuration. This issue doesn't affect upstream version of pure-ftpd.
Other sources
When rebasing pure-ftpd in Fedora 26, 27 and Rawhide, a packaging error occurred due to which the original configuration was ignored after update and service started running with default configuration. This has security implications because of overriding security-related configuration as well.
This issue is Fedora-specific and affected Fedora 26, 27 and Rawhide. The affected downstream version is pure-ftpd-1.0.46-1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12170?
CVE-2017-12170 has a moderate severity due to allowing the service to run with insecure default configurations.
How do I fix CVE-2017-12170?
To fix CVE-2017-12170, update to a patched version of Pure-FTPd that addresses the packaging error.
Which versions of Fedora are affected by CVE-2017-12170?
Fedora versions 26 and 27 are affected by CVE-2017-12170.
What are the potential risks of CVE-2017-12170?
The potential risks include unauthorized access and exposure of sensitive data due to default configurations overriding user-defined security settings.
Is there a workaround for CVE-2017-12170?
A temporary workaround for CVE-2017-12170 is to manually reconfigure Pure-FTPd settings after an update.