CVE-2020-14149

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-06-15 · updated 2026-06-17
Weakness: CWE-476

Description

In uftpd before 2.12, handle_CWD in ftpcmd.c mishandled the path provided by the user, causing a NULL pointer dereference and denial of service, as demonstrated by a CWD /.. command.

Affected products

troglobit uftpd: before 2.12 — fixed in 2.12

How to fix

Upgrade to a fixed version: troglobit uftpd 2.12. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00052.html
https://bugs.gentoo.org/726308
https://github.com/troglobit/uftpd/issues/30
https://github.com/troglobit/uftpd/releases/tag/v2.12
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00052.html
https://bugs.gentoo.org/726308
https://github.com/troglobit/uftpd/issues/30
https://github.com/troglobit/uftpd/releases/tag/v2.12

Get alerted when CVE-2020-14149 or the next vulnerability affects your stack