A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a …

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2021-4189 · Microsoft / collected KEV context

cve-program · CVE-2021-4189

• https://bugs.python.org/issue43285
• https://python-security.readthedocs.io/vuln/ftplib-pasv.html
• https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e
• https://security-tracker.debian.org/tracker/CVE-2021-4189
• https://bugzilla.redhat.com/show_bug.cgi?id=2036020
• https://access.redhat.com/security/cve/CVE-2021-4189
• https://security.netapp.com/advisory/ntap-20221104-0004/
• https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
• https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html

No related operational record is retained in the current change model.