CVE-2021-4189

python: ftplib should not use the host from the PASV response

Severity Score

5.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

Se ha encontrado un fallo en Python, concretamente en la biblioteca del cliente FTP (File Transfer Protocol) en modo PASV (pasivo). El problema radica en cómo el cliente FTP confía en el host a partir de la respuesta PASV por defecto. Este fallo permite a un atacante configurar un servidor FTP malicioso que puede engañar a los clientes FTP para que sean conectados a una dirección IP y un puerto determinados. Esta vulnerabilidad podría conllevar a que los clientes FTP escanearan los puertos, lo que de otro modo no habría sido posible.

*Credits: N/A

CVSS Scores

NISTv3.1 5.3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-12-29 CVE Reserved
2022-03-28 CVE Published
2024-08-03 CVE Updated
2024-11-15 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-252: Unchecked Return Value

CAPEC

References (9)

URL	Tag	Source
https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html	Mailing List
https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html	Mailing List
https://security-tracker.debian.org/tracker/CVE-2021-4189	Third Party Advisory
https://security.netapp.com/advisory/ntap-20221104-0004	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://bugs.python.org/issue43285	2023-06-30
https://bugzilla.redhat.com/show_bug.cgi?id=2036020	2022-05-10
https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e	2023-06-30
https://python-security.readthedocs.io/vuln/ftplib-pasv.html	2023-06-30

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2021-4189	2022-05-10

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Python Search vendor "Python"		Python Search vendor "Python" for product "Python"				>= 3.6.0 < 3.6.14 Search vendor "Python" for product "Python" and version " >= 3.6.0 < 3.6.14"		-		Affected
Python Search vendor "Python"		Python Search vendor "Python" for product "Python"				>= 3.7.0 < 3.7.11 Search vendor "Python" for product "Python" and version " >= 3.7.0 < 3.7.11"		-		Affected
Python Search vendor "Python"		Python Search vendor "Python" for product "Python"				>= 3.8.0 < 3.8.9 Search vendor "Python" for product "Python" and version " >= 3.8.0 < 3.8.9"		-		Affected
Python Search vendor "Python"		Python Search vendor "Python" for product "Python"				>= 3.9.0 < 3.9.3 Search vendor "Python" for product "Python" and version " >= 3.9.0 < 3.9.3"		-		Affected
Python Search vendor "Python"		Python Search vendor "Python" for product "Python"				3.10.0 Search vendor "Python" for product "Python" and version "3.10.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0"		-		Affected
Redhat Search vendor "Redhat"		Software Collections Search vendor "Redhat" for product "Software Collections"				-		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0"		-		Affected
Netapp Search vendor "Netapp"		Ontap Select Deploy Administration Utility Search vendor "Netapp" for product "Ontap Select Deploy Administration Utility"				-		-		Affected