Safety vulnerability ID: 50765
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Python 3.6.14, 3.7.11, 3.8.9 and 3.9.3 include a fix for CVE-2021-4189: The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
https://python-security.readthedocs.io/vuln/ftplib-pasv.html
Latest version: 0.9.8
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible. See CVE-2021-4189.
MISC:https://access.redhat.com/security/cve/CVE-2021-4189: https://access.redhat.com/security/cve/CVE-2021-4189
MISC:https://bugs.python.org/issue43285: https://bugs.python.org/issue43285
MISC:https://bugzilla.redhat.com/show_bug.cgi?id=2036020: https://bugzilla.redhat.com/show_bug.cgi?id=2036020
MISC:https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e: https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e
MISC:https://python-security.readthedocs.io/vuln/ftplib-pasv.html: https://python-security.readthedocs.io/vuln/ftplib-pasv.html
MISC:https://security-tracker.debian.org/tracker/CVE-2021-4189: https://security-tracker.debian.org/tracker/CVE-2021-4189
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application