CVE catalog

CVE-2014-8517

tnftp: CVE-2014-8517

Severity: Medium
Published: Nov 17, 2014, 4:59:05 PM UTC
Source: [NVD] · [CVE record]
EPSS: 69.12% · Oct 25, 2026

The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	tnftp	sid	`20260211-2`	fixed
Debian	tnftp	forky	`20260211-2`	fixed
Debian	tnftp	trixie	`20230507-2`	fixed
Debian	tnftp	bookworm	`20210827-4`	fixed
Opensuse	tnftp	tumbleweed	`20151004-1.3`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	tnftp	source	sid	`20130505-2`	low	Not reported	[767171]
Debian	tnftp	source	forky	`20130505-2`	low	Not reported	[767171]
Debian	tnftp	source	trixie	`20130505-2`	low	Not reported	[767171]
Debian	tnftp	source	bookworm	`20130505-2`	low	Not reported	[767171]
Opensuse	tnftp	rpm	tumbleweed	`20151004-1.3`	Not reported	OPENSUSE-SU-2024:10306-1	Not reported

[Debian bug #767171]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[ftp]Fixed
Source package: [tnftp]
Details (2)
- 20210827-4 · all · bookworm
  Fixed · Fixed: 20130505-2
  dsa · tnftp · debian · bookworm; dsa · tnftp · debian · 12
- 20210827-4 · all · bookworm
  Fixed · Fixed: 20130505-2
  dsa · tnftp · debian · bookworm; dsa · tnftp · debian · 12
[tnftp]Fixed
Source package: [tnftp]
Details (2)
- 20210827-4+b1 · amd64 · bookworm
  Fixed · Fixed: 20130505-2
  dsa · tnftp · debian · bookworm; dsa · tnftp · debian · 12
- 20210827-4+b1 · arm64 · bookworm
  Fixed · Fixed: 20130505-2
  dsa · tnftp · debian · bookworm; dsa · tnftp · debian · 12

[Debian 13 (Trixie)]

[ftp]Fixed
Source package: [tnftp]
Details (2)
- 20230507-2 · all · trixie
  Fixed · Fixed: 20130505-2
  dsa · tnftp · debian · 13
- 20230507-2 · all · trixie
  Fixed · Fixed: 20130505-2
  dsa · tnftp · debian · 13
[tnftp]Fixed
Source package: [tnftp]
Details (2)
- 20230507-2+b1 · amd64 · trixie
  Fixed · Fixed: 20130505-2
  dsa · tnftp · debian · 13
- 20230507-2+b2 · arm64 · trixie
  Fixed · Fixed: 20130505-2
  dsa · tnftp · debian · 13

[openSUSE Tumbleweed]

[tnftp]Fixed
Source package: [tnftp]
Details (1)
- 20260211-2.4 · x86_64 · tumbleweed
  Fixed · Fixed: 20151004-1.3
  dsa · tnftp · opensuse · tumbleweed

Observed: Oct 23, 2026, 5:12:08 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]