Bug 2563946 (CVE-2026-119567)
| Summary: | CVE-2026-119567 vsftpd: vsftpd: access control bypass via RFC 775 command aliases | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in vsftpd. This vulnerability allows an authenticated remote attacker to bypass access control restrictions and execute denied operations. Because the service performs exact string matching against restricted command names without accounting for legacy command aliases defined in RFC 775, an attacker can submit equivalent X-prefixed commands to perform prohibited directory operations.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2565139 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-30 11:55:29 UTC
|