CVE-2021-4189

תיאור (מקור, אנגלית)

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

מדדים

CVSS 3.1

5.3 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS — סבירות ניצול

3% (אחוזון 100) נכון ל-14/10/2026

CWE

CWE-252

מוצרים מושפעים

python: python; debian: debian linux; redhat: software collections; redhat: enterprise linux; netapp: ontap select deploy administration utility

קישורים

• https://bugs.python.org/issue43285 PatchVendor Advisory
• https://bugs.python.org/issue43285 PatchVendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2036020 Issue TrackingPatchThird Party Advisory
• https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f1‮… PatchThird Party Advisory
• https://python-security.readthedocs.io/vuln/ftplib-pasv.html PatchThird Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2036020 Issue TrackingPatchThird Party Advisory
• https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f1‮… PatchThird Party Advisory
• https://python-security.readthedocs.io/vuln/ftplib-pasv.html PatchThird Party Advisory
• https://access.redhat.com/security/cve/CVE-2021-4189 Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html