onyx --cves cve-2021-4189
CVE-2021-4189
- score
- 0.1
- cvss
- 5.3
- epss
- 3.4% ▲0.2
- published
- 2022-08-24
- kev added
- —
- first seen
Python's FTP client library in PASV mode contains a flaw caused by trusting the host from the PASV response by default, letting attackers trick clients into connecting to malicious IPs, exploit requires connection to malicious FTP server.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 11
- https://access.redhat.com/security/cve/CVE-2021-4189
- https://bugzilla.redhat.com/show_bug.cgi?id=2036020
- https://python-security.readthedocs.io/vuln/ftplib-pasv.html
- https://security-tracker.debian.org/tracker/CVE-2021-4189
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e
- https://security.netapp.com/advisory/ntap-20221104-0004/
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
- https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://bugs.python.org/issue43285