Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
`basic-ftp` is named in `yarn.lock` in the rust source tarball, but the actual package is not present. Furthermore, that is not used in the build, nor included in any of our final packages.