Threats tagged 'ghsa-9r97-6c49-v2hf'

A vulnerability in the Linux kernel's netfilter nft_ct module related to sequence adjustment for NATted FTP connections using PASV/EPSV modes has been resolved. The issue arises because FTP traffic in these modes requires rewriting packet payloads, which affects TCP sequence and acknowledgment numbers. Without proper sequence adjustment, FTP NAT changes may fail, causing connection errors and service disruption. The problem occurs when the conntrack helper is assigned after DNAT setup, missing a required sequence adjustment extension. This can lead to denial of service for FTP clients using passive mode.