CVE-2021-4189

MEDIUM

Python 3.6.0-3.6.13 - FTP Client Passive Mode Connection Spoofing

Title source: llm
STIX 2.1

Description

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

References (10)

Core 10
Core References
Patch, Vendor Advisory
https://bugs.python.org/issue43285
Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2036020

Scores

CVSS v3 5.3
EPSS 0.0239
EPSS Percentile 81.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-252
Status published
Products (7)
debian/debian_linux 10.0
debian/debian_linux 11.0
netapp/ontap_select_deploy_administration_utility
python/python 3.10.0
python/python 3.6.0 - 3.6.14
redhat/enterprise_linux 8.0
redhat/software_collections
Published Aug 24, 2022
Tracked Since Feb 18, 2026