CVE-2020-35359: 
Pure-FTPd vulnerability analysis and mitigation

Pure-FTPd version 1.0.48 contains a denial of service vulnerability (CVE-2020-35359) that was disclosed on December 26, 2020. The vulnerability allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection limit (NVD, CVE).

The vulnerability has a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The issue stems from the server's connection handling mechanism, where attackers can exploit the lack of proper connection limiting (NVD).

When exploited, this vulnerability can prevent legitimate users from accessing the FTP server by exhausting available connection slots. The attack primarily affects the availability of the service, with no direct impact on confidentiality or integrity (NVD).

System administrators should implement proper connection limiting per IP address and consider upgrading to a newer version of Pure-FTPd if available. Additionally, implementing rate limiting at the network level can help mitigate this type of attack.