PT-2021-6846 · Python+11 · Python+11

Confd0 · Published 2021-04-05 · Updated 2026-05-13 · CVE-2021-4189

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Python (affected versions not specified)

Description The issue is related to the FTP client library in Python, specifically in PASV (passive) mode, where the library trusts the host from the PASV response by default. This allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port, potentially leading to FTP client scanning ports.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unchecked Return Value

SSRF

Weakness Enumeration

CWE-252

CWE-918

Related Identifiers

ALSA-2022:1821

ALSA-2022:1986

ALT-PU-2021-1596

ALT-PU-2021-2653

ALT-PU-2022-1209

ALT-PU-2022-1471

ALT-PU-2022-3044

ALT-PU-2023-4581

ALT-PU-2024-3474

BDU:2022-02303

BIT-LIBPYTHON-2021-4189

BIT-PYTHON-2021-4189

BIT-PYTHON-MIN-2021-4189

CESA-2022_1821

CESA-2022_1986

CVE-2021-4189

DLA-2919-1

DLA-3432-1

DLA-3477-1

DLA-3980-1

MGASA-2022-0367

OESA-2022-1566

OPENSUSE-SU-2022:1091-1

OPENSUSE-SU-2022_1091-1

OPENSUSE-SU-2024:11835-1

RHSA-2021:3254

RHSA-2022:1663

RHSA-2022:1821

RHSA-2022:1986

RHSA-2022_1821

RHSA-2022_1986

RLSA-2022:1821

SUSE-SU-2022:0882-1

SUSE-SU-2022:1091-1

SUSE-SU-2022:1140-1

SUSE-SU-2022_0882-1

SUSE-SU-2022_1140-1

USN-5342-1

USN-5342-2

USN-6891-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Debian

Linuxmint

Python

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 138

• https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e · Patch
• https://ubuntu.com/security/notices/USN-6891-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-1821.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/UIOJUZ5JMEMGSKNISTOVI4PDP36FDL5Y · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3737 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0391 · Security Note
• https://ubuntu.com/security/CVE-2019-5010 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27619 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26116 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9740 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-18348 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2036020 · Patch
• https://ubuntu.com/security/notices/USN-5342-2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/W5664BGZVTA46LQDNTYX5THG6CN4FYJX · Vendor Advisory
• https://osv.dev/vulnerability/BIT-libpython-2021-4189 · Vendor Advisory