CVE-2021-4189

Published: Aug 24, 2022Modified: Dec 17, 2025

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

Affected (10)

Products: Python: Python · Debian: Debian Linux · Redhat: Enterprise Linux, Software Collections · +1 more

Show all products

Python: Python · Debian: Debian Linux · Redhat: Enterprise Linux, Software Collections · Netapp: Ontap Select Deploy Administration Utility

1 product

1 product

2 products

Enterprise Linux

Software Collections

1 product

Ontap Select Deploy Administration Utility

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Python Python	From 3.6.0 to 3.6.14
Python Python	From 3.7.0 to 3.7.11
Python Python	From 3.8.0 to 3.8.9
Python Python	From 3.9.0 to 3.9.3
Python Python	Version 3.10.0

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Software Collections	All versions

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Ontap Select Deploy Administration Utility	All versions

Related CWEs

Unchecked Return Value

The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

References (19)

https://access.redhat.com/security/cve/CVE-2021-4189

Source: secalert@redhat.com

Third Party Advisory

https://bugs.python.org/issue43285

Source: secalert@redhat.com

PatchVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2036020

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e

Source: secalert@redhat.com

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html

Source: secalert@redhat.com

https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html

Source: secalert@redhat.com

https://python-security.readthedocs.io/vuln/ftplib-pasv.html

Source: secalert@redhat.com

PatchThird Party Advisory

https://security-tracker.debian.org/tracker/CVE-2021-4189

Source: secalert@redhat.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20221104-0004/

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/security/cve/CVE-2021-4189

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugs.python.org/issue43285

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2036020

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://python-security.readthedocs.io/vuln/ftplib-pasv.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://security-tracker.debian.org/tracker/CVE-2021-4189

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20221104-0004/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.