PT-2022-6127 · Apache+4 · Apache Commons Net+4

Zeddyu Lu · Published 2022-03-28 · Updated 2025-12-16 · CVE-2021-37533

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Commons Net versions prior to 3.9.0

Description The issue is related to the FTP client in Apache Commons Net, which trusts the host from PASV response by default. This allows a malicious server to redirect the Commons Net code to use a different host, potentially leading to leakage of information about services running on the private network of the client. The default behavior was changed in version 3.9.0 to ignore such hosts.

Recommendations For versions prior to 3.9.0, update to version 3.9.0 or later to change the default behavior and ignore hosts from PASV responses. As a temporary workaround, consider configuring the FTP client to not trust hosts from PASV responses.

Fix

Open Redirect

RCE

Weakness Enumeration

CWE-601

CWE-20

Related Identifiers

BDU:2023-00080

CVE-2021-37533

DLA-3251-1

DSA-5307-1

GHSA-CGP8-4M63-FHH5

OESA-2023-1882

OPENSUSE-SU-2024:12549-1

USN-6037-1

Affected Products

Apache Commons Net

Astra Linux

Linuxmint

Red Os

Ubuntu

References · 33

• https://ubuntu.com/security/CVE-2021-37533 · Vendor Advisory
• https://debian.org/security/2022/dsa-5307 · Vendor Advisory
• https://lists.apache.org/thread/o6yn9r9x6s94v97264hmgol1sf48mvx7 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-37533 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cgp8-4m63-fhh5 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1882 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-37533 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6037-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00080 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-37533 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37533 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-37533 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37533 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12549-1 · Vendor Advisory