CVEvulnerability
CVE-2021-4189
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-08-24
- Last modified
- 2026-10-14
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-252
Description
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
Affected configurations
• python python (>= 3.6.0 < 3.6.14)
• python python (>= 3.7.0 < 3.7.11)
• python python (>= 3.8.0 < 3.8.9)
• python python (>= 3.9.0 < 3.9.3)
• python python 3.10.0
• debian debian linux 10.0
• debian debian linux 11.0
• redhat software collections
• redhat enterprise linux 8.0
• netapp ontap select deploy administration utility
Related
Weakness · CWE (1)
- CWE-252 Unchecked Return Value weakness
References
- https://access.redhat.com/security/cve/CVE-2021-4189 Third Party Advisory
- https://bugs.python.org/issue43285 Patch, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2036020 Issue Tracking, Patch, Third Party Advisory
- https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html lists.debian.org
- https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html lists.debian.org
- https://python-security.readthedocs.io/vuln/ftplib-pasv.html Patch, Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2021-4189 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20221104-0004/ Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2021-4189 Third Party Advisory
- https://bugs.python.org/issue43285 Patch, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2036020 Issue Tracking, Patch, Third Party Advisory
- https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html lists.debian.org
- https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html lists.debian.org
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html lists.debian.org
- https://python-security.readthedocs.io/vuln/ftplib-pasv.html Patch, Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2021-4189 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20221104-0004/ Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html cert-portal.siemens.com