CVE-2020-14149

[CVE catalog]

This update for uftpd fixes the following issues: uftpd was updated to version 2.12. Changes: * Use common log message format and log level when user enters an invalid path. This unfortunately affects changes introduced in v2.11 to increase logging at default log level. Security fixes: - CVE-2020-14149: When entering an invalid directory with the FTP command CWD, a NULL ptr was deref. in a DBG() message even though the log level is set to a value lower than LOG_DEBUG. This caused uftpd to crash and cause denial of service. Depending on the init/inetd system used this could be permanent. (boo#1172959)

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Jun 25, 2020, 12:18:25 PM UTC

Updated

May 7, 2025, 6:11:30 PM UTC

Source

[NVD] · [CVE record]

EPSS

2.32% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "uftpd",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.12-lp151.2.6.1"
            }
          ]
        }
      ],
      "release": "leap 15.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2020:0865-1",
      "fixed_version": "2.12-lp151.2.6.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2020:0865-1",
      "provider_updated_at": "2025-05-07T18:11:30.486330Z"
    }
  ]
}