Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2021-4189

Date: August 23, 2022

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

Severity Score

Related Resources (12)

https://access.redhat.com/security/cve/CVE-2021-4189
https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e
https://python-security.readthedocs.io/vuln/ftplib-pasv.html
https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
https://nvd.nist.gov/vuln/detail/CVE-2021-4189
https://security.netapp.com/advisory/ntap-20221104-0004/
https://security-tracker.debian.org/tracker/CVE-2021-4189
https://bugs.python.org/issue43285
https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
https://people.canonical.com/~ubuntu-security/cve/CVE-2021-4189
https://bugzilla.redhat.com/show_bug.cgi?id=2036020
https://www.mend.io/vulnerability-database/CVE-2021-4189

Severity Score

Weakness Type (CWE)

Unchecked Return Value

CWE-252

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us