(ftplib) A remote attacker could possibly attack by containing the newline characters

[corona10]

BPO	30119
Nosy	@birkenfeld, @vstinner, @larryhastings, @giampaolo, @benjaminp, @ned-deily, @vadmium, @corona10
PRs	bpo-30119: Fix ftplib to handle the ftp user's commands. #1214 [3.3] bpo-30119: fix ftplib.FTP.putline() to throw an error for a illegal command (#1214) #2885 [3.6] bpo-30119: fix ftplib.FTP.putline() to throw an error for a illegal command (#1214) #2886 [3.5] bpo-30119: fix ftplib.FTP.putline() to throw an error for a illegal command (#1214) #2887 [3.4] bpo-30119: fix ftplib.FTP.putline() to throw an error for a illegal command (#1214) #2893 [2.7] bpo-30119: fix ftplib.FTP.putline() to throw an error for a illegal command (#1214) #2894

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2017-07-28.04:07:50.206>
created_at = <Date 2017-04-20.17:57:20.239>
labels = ['type-security', '3.7']
title = '(ftplib) A remote attacker could possibly attack by containing the newline characters'
updated_at = <Date 2019-05-10.18:12:00.146>
user = 'https://github.com/corona10'

bugs.python.org fields:

activity = <Date 2019-05-10.18:12:00.146>
actor = 'ned.deily'
assignee = 'none'
closed = True
closed_date = <Date 2017-07-28.04:07:50.206>
closer = 'ned.deily'
components = []
creation = <Date 2017-04-20.17:57:20.239>
creator = 'corona10'
dependencies = []
files = []
hgrepos = []
issue_num = 30119
keywords = ['security_issue']
message_count = 20.0
messages = ['291988', '292556', '292557', '292591', '292693', '298860', '299141', '299182', '299199', '299204', '299205', '299209', '299212', '299225', '299226', '299228', '299229', '299230', '299242', '299341']
nosy_count = 8.0
nosy_names = ['georg.brandl', 'vstinner', 'larry', 'giampaolo.rodola', 'benjamin.peterson', 'ned.deily', 'martin.panter', 'corona10']
pr_nums = ['1214', '2885', '2886', '2887', '2893', '2894']
priority = None
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue30119'
versions = ['Python 2.7', 'Python 3.3', 'Python 3.4', 'Python 3.5', 'Python 3.6', 'Python 3.7']

[corona10]

It was discovered that the FTP client implementation in the Networking component of Python failed to correctly handle user inputs.
A remote attacker could possibly use this flaw to manipulate an FTP connection opened by a Python application if it could make it access a specially crafted FTP URL.

See
http://blog.blindspotsecurity.com/2017/02/advisory-javapython-ftp-injections.html

and https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-3533

I upload the patch for this issue.

[corona10]

One of the purposes of the JDK patch is to prevent '\ r' and '\ n' from being inserted into the ftp command. In particular, it seems to assume that if another malice command is inserted after '\ n', the possibility of such an attack will be opened at a later time.
IMO, I think that we can block '\ r \ n' and '\ n' at the same time by blocking only '\ n'. Although '\ r' allows

[corona10]

'\ r' -> '\r'
'\ n' -> '\n'

[vadmium]

I suggest to close this as a duplicate. The pull request itself looks like the right direction to me, but let’s not split the discussion up more than necessary.

[giampaolo]

The relevant discussion of this bug is happening in #1214.

[giampaolo]

New changeset 2b1e6e9 by Giampaolo Rodola (Dong-hee Na) in branch 'master':
bpo-30119: fix ftplib.FTP.putline() to throw an error for a illegal command (bpo-1214)
2b1e6e9

[giampaolo]

Reopening as it needs backports for 2.7, 3.3, 3.4, 3.5 and 3.6.

[vstinner]

What about rejecting also NUL byte?

[vstinner]

I closed bpo-29606 as a duplicate of this bug.

[ned-deily]

Just FYI, if the backports to 3.5, 3.4, and 3.3 happen *really* fast, we *might* be able to get them into the current round of releases, if Larry approves for 3.5.4 final and 3.4.7 final. If the 3.3 backport doesn't happen soon, 3.3 will reach end of life without it.