CVE-2021-4189
published 2022-08-24CVE-2021-4189: A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the…
medium5.3CVSS 4.0
AVNACLPRNUINSUCLINAN
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | pypy3 | < pypy3 7.3.5+dfsg-2 (bookworm) | pypy3 7.3.5+dfsg-2 (bookworm) |
| debian | python2.7 | < pypy3 7.3.5+dfsg-2 (bookworm) | pypy3 7.3.5+dfsg-2 (bookworm) |
| debian | python3.9 | < pypy3 7.3.5+dfsg-2 (bookworm) | pypy3 7.3.5+dfsg-2 (bookworm) |
| python | python | — | — |
| python | python | >= 3.6.0 < 3.6.14 | 3.6.14 |
| python | python | >= 3.7.0 < 3.7.11 | 3.7.11 |
| python | python | >= 3.8.0 < 3.8.9 | 3.8.9 |
| python | python | >= 3.9.0 < 3.9.3 | 3.9.3 |
| python_software_foundation | cpython | < 3.15.0 | 3.15.0 |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv4.05.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
osv7.6HIGH
GHSA
GHSA-j989-fggp-qgp5: The ftpcp() function in Lib/ftplib
ghsa_unreviewed·2026-05-13·CVSS 5.3
CVE-2026-8328 [MEDIUM] CWE-918 GHSA-j989-fggp-qgp5: The ftpcp() function in Lib/ftplib
The ftpcp() function in Lib/ftplib.py was not updated when
CVE-2021-4189 was fixed. While makepasv() was patched to replace
server-supplied PASV host addresses with the actual peer address
(getpeername()[0]), ftpcp() still calls parse227() directly and passes
the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
OSV
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
osv·2024-07-11·CVSS 7.6
CVE-2015-20107 [HIGH] python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS.
(CVE-2015-20107)
It was discovered that Python incorrectly used regular expressions
vulnerable to catastrophic backtracking. A remote attacker could possibly
use this issue to cause a denial of service. This issue only affected
Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat’s hash salt. A
remote attacker could possibly use this issue to cause hash collisions,
leading to a denial of service. This issue only affected Ubuntu 14.04 L
GHSA
GHSA-67xf-xphq-9mcc: A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode
ghsa_unreviewed·2022-08-25
CVE-2021-4189 [MEDIUM] CWE-252 GHSA-67xf-xphq-9mcc: A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
OSV
CVE-2021-4189: A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode
osv·2022-08-24·CVSS 5.3
CVE-2021-4189 [MEDIUM] CVE-2021-4189: A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
OSV
python2.7 vulnerabilities
osv·2022-08-24·CVSS 5.3
CVE-2021-4189 [MEDIUM] python2.7 vulnerabilities
python2.7 vulnerabilities
USN-5342-1 fixed several vulnerabilities in Python. This update provides
the corresponding update for Ubuntu 14.04 ESM, Ubuntu 20.04 ESM and
Ubuntu 22.04 ESM.
Original advisory details:
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2022-0391)
OSV
python3.7 vulnerability
osv·2022-05-23·CVSS 5.7
CVE-2021-3426 [MEDIUM] python3.7 vulnerability
python3.7 vulnerability
USN-5342-1 fixed several vulnerabilities in Python. This update provides
the corresponding fix for CVE-2021-3426 for Ubuntu 18.04 ESM.
Original advisory details:
David Schwörer discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3426)
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2022-0391)
OSV
python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities
osv·2022-03-28·CVSS 5.7
CVE-2021-3426 [MEDIUM] python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities
python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities
David Schwörer discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3426)
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2022-0391)
Ubuntu
Python vulnerabilities
vendor_ubuntu·2024-07-11·CVSS 7.6
CVE-2021-29921 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS.
(CVE-2015-20107)
It was discovered that Python incorrectly used regular expressions
vulnerable to catastrophic backtracking. A remote attacker could possibly
use this issue to cause a denial of service. This issue only affected
Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat’s hash salt. A
remote attacker could possibly use this issue to cause hash collisions,
leading to a denial of service. This issue only affected Ubuntu 14.04 LTS.
(CVE-2018-14647)
CISA ICS
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
cisa_ics·2023-12-14
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Release DateDecember 14, 2023
Alert CodeICSA-23-348-10
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
- Vulnerabilities: Improper Restriction of XML External Entity Reference, Time-of-check Time-of-use (TOCTOU) Race Condition, Command Injection, Miss
Ubuntu
Python vulnerabilities
vendor_ubuntu·2022-08-24·CVSS 5.3
CVE-2022-0391 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
USN-5342-1 fixed several vulnerabilities in Python. This update provides
the corresponding update for Ubuntu 14.04 ESM, Ubuntu 20.04 ESM and
Ubuntu 22.04 ESM.
Original advisory details:
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2022-0391)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Python vulnerability
vendor_ubuntu·2022-05-23·CVSS 5.7
CVE-2021-3426 [MEDIUM] Python vulnerability
Title: Python vulnerability
Summary: Python could be made to expose sensitive information.
USN-5342-1 fixed several vulnerabilities in Python. This update provides
the corresponding fix for CVE-2021-3426 for Ubuntu 18.04 ESM.
Original advisory details:
David Schwörer discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3426)
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could pos
Ubuntu
Python vulnerabilities
vendor_ubuntu·2022-03-28·CVSS 5.7
CVE-2022-0391 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
David Schwörer discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3426)
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2022-0391)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python: ftplib should not use the host from the PASV response
vendor_redhat·2021-12-21·CVSS 5.3
CVE-2021-4189 [MEDIUM] CWE-252 python: ftplib should not use the host from the PASV response
python: ftplib should not use the host from the PASV response
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients i
Debian
CVE-2021-4189: pypy3 - A flaw was found in Python, specifically in the FTP (File Transfer Protocol) cli...
vendor_debian·2021·CVSS 5.3
CVE-2021-4189 [MEDIUM] CVE-2021-4189: pypy3 - A flaw was found in Python, specifically in the FTP (File Transfer Protocol) cli...
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
Scope: local
bookworm: resolved (fixed in 7.3.5+dfsg-2)
bullseye: resolved (fixed in 7.3.5+dfsg-2)
forky: resolved (fixed in 7.3.5+dfsg-2)
sid: resolved (fixed in 7.3.5+dfsg-2)
trixie: resolved (fixed in 7.3.5+dfsg-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://access.redhat.com/security/cve/CVE-2021-4189https://bugs.python.org/issue43285https://bugzilla.redhat.com/show_bug.cgi?id=2036020https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188ehttps://lists.debian.org/debian-lts-announce/2023/05/msg00024.htmlhttps://lists.debian.org/debian-lts-announce/2023/06/msg00039.htmlhttps://python-security.readthedocs.io/vuln/ftplib-pasv.htmlhttps://security-tracker.debian.org/tracker/CVE-2021-4189https://security.netapp.com/advisory/ntap-20221104-0004/https://access.redhat.com/security/cve/CVE-2021-4189https://bugs.python.org/issue43285https://bugzilla.redhat.com/show_bug.cgi?id=2036020https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188ehttps://lists.debian.org/debian-lts-announce/2023/05/msg00024.htmlhttps://lists.debian.org/debian-lts-announce/2023/06/msg00039.htmlhttps://lists.debian.org/debian-lts-announce/2024/12/msg00000.htmlhttps://python-security.readthedocs.io/vuln/ftplib-pasv.htmlhttps://security-tracker.debian.org/tracker/CVE-2021-4189https://security.netapp.com/advisory/ntap-20221104-0004/
2022-08-24
Published