CVE-2021-4189: Medium severity IBM Cloud Pak for Security vulnerability
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
Other sources
Python could allow a remote attacker to obtain sensitive information, caused by a flaw when using the FTP client library in PASV (passive) mode. By using a specially-crafted FTP server, an attacker could exploit this vulnerability to obtain service banner information from private network., and use this information to launch further attacks against the affected system.
— IBM
The problem is ftp client trust the host from PASV response by default, A malicious server can trick ftp client into connecting back to a given IP address and port. This may make ftp client scan ports and extract service banner from private network.
References: https://bugs.python.org/issue43285
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-4189?
CVE-2021-4189 is a vulnerability found in Python's FTP (File Transfer Protocol) client library in PASV (passive) mode.
How does the vulnerability in CVE-2021-4189 affect Python?
The vulnerability in CVE-2021-4189 allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting to it.
What is the severity level of CVE-2021-4189?
The severity level of CVE-2021-4189 is medium, with a CVSS score of 5.3.
Which versions of Python are affected by CVE-2021-4189?
The versions affected by CVE-2021-4189 are Python 3.6.14, Python 3.7.11, Python 3.8.9, Python 3.9.3, and Python 3.10.0.
How can I fix the vulnerability in Python identified as CVE-2021-4189?
To fix the vulnerability in Python identified as CVE-2021-4189, you should update to Python versions 3.6.14, 3.7.11, 3.8.9, 3.9.3, or 3.10.0, depending on the version you are currently using.