QID 983063
QID 983063: Nodejs (npm) Security Update for ftp-srv (GHSA-jw37-5gqr-cf9j)
Security update has been released for ftp-srv to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.
Solution
* _fix: disallow PORT connections to alternate hosts_: e449e75219d918c400dec65b4b0759f60476abca
Deprecation notices have been published for older versions.Workaround:
Blacklisting the FTP Command `PORT` will prevent the server from exposing this behaviour through active connections until a fix is applied.
```js
const ftp = new FtpSrv({
blacklist: ['PORT']
});
```
Deprecation notices have been published for older versions.Workaround:
Blacklisting the FTP Command `PORT` will prevent the server from exposing this behaviour through active connections until a fix is applied.
```js
const ftp = new FtpSrv({
blacklist: ['PORT']
});
```
Vendor References
- GHSA-jw37-5gqr-cf9j -
github.com/advisories/GHSA-jw37-5gqr-cf9j
CVEs related to QID 983063
Software Advisories
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-jw37-5gqr-cf9j | ftp-srv |
github.com/advisories/GHSA-jw37-5gqr-cf9j |