Repository navigation
fix: check the protection of the data connection in TransferOpen - #685
Merged
Merged
Conversation
Without this patch, a client that sends the PROT P command after a PASV or PORT command would receive data in the clear. Since standard clients do not behave this way, this represents the minimum fix: in such a scenario, an error is returned instead of transmitting the data in the clear.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #685 +/- ##
==========================================
+ Coverage 91.08% 91.11% +0.02%
==========================================
Files 13 13
Lines 2108 2115 +7
==========================================
+ Hits 1920 1927 +7
Misses 175 175
Partials 13 13 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
drakkan
force-pushed
the
fix-prot-after-pasv
branch
from
October 23, 2026 06:42
4eceaa3 to
995c2d1
Compare
drakkan
changed the title
Collaborator
Author
|
I noticed this was also reported as CVE from VulnCheck: @fclairamb sorry, although it is not possible to report security issues privately in this repository, I should have contacted you privately in other ways. |
Owner
|
Hi @drakkan, no problem. I will define a better security rule. Thank you for your fix! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Without this patch, a client that sends the PROT P command after a PASV or PORT command would receive data in the clear. Since standard clients do not behave this way, this represents the minimum fix: in such a scenario, an error is returned instead of transmitting the data in the clear.
This is a minimal port derived from the fork I use in SFTPGo Enterprise; it resolves an issue reported in the open-source version of SFTPGo, which uses the unmodified ftpserverlib.