A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
Fix
Patch, vendor advisory and mitigation references on NVD 8
- https://bugs.python.org/issue43285 Patch, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2036020 Issue Tracking, Patch, Third Party Advisory
- https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e Patch, Third Party Advisory
- https://python-security.readthedocs.io/vuln/ftplib-pasv.html Patch, Third Party Advisory
- https://bugs.python.org/issue43285 Patch, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2036020 Issue Tracking, Patch, Third Party Advisory
- https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e Patch, Third Party Advisory
- https://python-security.readthedocs.io/vuln/ftplib-pasv.html Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · python, debian, redhatNVD modified 2026-10-14 11:16
Affected (CPE criteria) 7
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*cpe:2.3:a:python:python:3.10.0:-:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
References 20
- https://access.redhat.com/security/cve/CVE-2021-4189 Third Party Advisory
- https://bugs.python.org/issue43285 Patch, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2036020 Issue Tracking, Patch, Third Party Advisory
- https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
- https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
- https://python-security.readthedocs.io/vuln/ftplib-pasv.html Patch, Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2021-4189 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20221104-0004/ Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2021-4189 Third Party Advisory
- https://bugs.python.org/issue43285 Patch, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2036020 Issue Tracking, Patch, Third Party Advisory
- https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
- https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://python-security.readthedocs.io/vuln/ftplib-pasv.html Patch, Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2021-4189 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20221104-0004/ Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html