Описание
The ftpcp() function in Lib/ftplib.py was not updated when
CVE-2021-4189 was fixed. While makepasv() was patched to replace
server-supplied PASV host addresses with the actual peer address
(getpeername()[0]), ftpcp() still calls parse227() directly and passes
the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
A flaw was found in the ftplib.py module of Python. This vulnerability allows a remote attacker to bypass a previous security fix by manipulating the ftpcp() function. By supplying a malicious IP address and port, an attacker can redirect FTP connections to an arbitrary host. This could lead to the compromise of data integrity or other network-based attacks.
Отчет
A flaw with Important impact was found in the ftplib module of Python, affecting the Python components shipped in Red Hat Hardened Images. The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed: although makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address, ftpcp() still calls parse227() directly and passes the raw, attacker-controllable IP address and port to target.sendport(). A remote attacker who controls or has compromised an FTP server can therefore supply a malicious PASV response that redirects the FTP data connection to an arbitrary host, which can compromise data integrity or enable further network-based attacks. Within Red Hat Hardened Images, the python3.10, python3.11, python3.12, python3.13, and python3.14 components are affected; their resolution is delegated to the Red Hat Hardened Images maintainers, and updated packages have been released via errata. The hi/python OCI image is not affected because the vulnerable component is not present in that image. Red Hat rates the overall impact of this flaw as Important, while the CVSS scores assigned by both Red Hat (5.3, CVSS:3.1, Moderate) and upstream (5.9, CVSS:4.0, Moderate) are lower; the vectors differ mainly in that upstream scores the consequence as high integrity impact with user interaction required, whereas the Red Hat vector scores a low confidentiality impact.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | hi/python | Not affected | ||
| Red Hat Hardened Images | python3-14-main-3.14.7-1.2.hum1 | Fixed | RHSA-2026:67572 | 15.09.2026 |
| Red Hat Hardened Images | python3-10-main-3.10.21-1.3.hum1 | Fixed | RHSA-2026:68132 | 16.09.2026 |
| Red Hat Hardened Images | python3-11-main-3.11.16-1.4.hum1 | Fixed | RHSA-2026:68135 | 16.09.2026 |
| Red Hat Hardened Images | python3-12-main-3.12.14-1.3.hum1 | Fixed | RHSA-2026:68154 | 16.09.2026 |
| Red Hat Hardened Images | python3-13-main-3.13.15-1.3.hum1 | Fixed | RHSA-2026:68309 | 16.09.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4 ...
EPSS
5.3 Medium
CVSS3