CVE-2014-8517

Name	CVE-2014-8517
Description	The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a \| (pipe) character at the end of an HTTP redirect.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	high
Debian Bugs	767171

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
tnftp (PTS)	buster, stretch	20130505-3	fixed
	bullseye, sid	20200705-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
tnftp	source	(unstable)	20130505-2	low		767171

[wheezy] - tnftp <no-dsa> (Minor issue)
[squeeze] - tnftp <no-dsa> (Minor issue)
https://www.openwall.com/lists/oss-security/2014/10/28/4