Description
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
Scores
CVSS v3
5.3
EPSS
0.0106
EPSS Percentile
77.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-252
Status
published
Products (7)
debian/debian_linux
10.0
debian/debian_linux
11.0
netapp/ontap_select_deploy_administration_utility
python/python
3.10.0
python/python
3.6.0 - 3.6.14
redhat/enterprise_linux
8.0
redhat/software_collections
Published
Aug 24, 2022
Tracked Since
Feb 18, 2026