{"id":"CVE-2021-4189","details":"A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.","aliases":["BIT-libpython-2021-4189","BIT-python-2021-4189","BIT-python-min-2021-4189"],"modified":"2026-11-12T02:45:08.520857033Z","published":"2022-08-24T16:15:09.827Z","related":["ALSA-2022:1821","ALSA-2022:1986","SUSE-SU-2022:0882-1","SUSE-SU-2022:1091-1","SUSE-SU-2022:1140-1","SUSE-SU-2026:22959-1","SUSE-SU-2026:23743-1","SUSE-SU-2026:4534-1","openSUSE-SU-2022:1091-1","openSUSE-SU-2024:11835-1","openSUSE-SU-2026:11101-1","openSUSE-SU-2026:11181-1","openSUSE-SU-2026:11342-1","openSUSE-SU-2026:11747-1","openSUSE-SU-2026:11756-1","openSUSE-SU-2026:11757-1","openSUSE-SU-2026:12477-1","openSUSE-SU-2026:21459-1"],"database_specific":{"unresolved_ranges":[{"vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*"],"extracted_events":[{"range":[{"introduced":"10.0"},{"last_affected":"10.0"},{"introduced":"11.0"},{"last_affected":"11.0"}],"source":"CPE_STRING"}]},{"extracted_events":[{"range":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING"}],"vendor_product":"redhat:enterprise_linux","cpes":["cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"]}]},"references":[{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2021-4189"},{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2021-4189"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20221104-0004/"},{"type":"FIX","url":"https://bugs.python.org/issue43285"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036020"},{"type":"FIX","url":"https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e"},{"type":"FIX","url":"https://python-security.readthedocs.io/vuln/ftplib-pasv.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python/cpython","events":[{"introduced":"5c4568a05a0a62b5947c55f68f9f2ecfb90a4f12"},{"fixed":"9a0099d1bf14bce417370aae6d55527417cda354"},{"introduced":"1bf9cc509326bc42cd8cb1650eb9bf64550d817e"},{"fixed":"9da28d2b3429d1bb30e082e4c9cb544d81fdae20"},{"introduced":"fa919fdf2583bdfead1df00e842f24f30b2a34bf"},{"fixed":"a743f8192b3b322b2c23b13926f1c7f288cb2206"},{"introduced":"9cf6752276e6fcfd0c23fdb064ad27f448aaaf75"},{"fixed":"e723086bc33c19c6c52046d515eb3c2aab1b8f97"},{"introduced":"b494f5935c92951e75597bfe1c8b1f3112fec270"},{"last_affected":"b494f5935c92951e75597bfe1c8b1f3112fec270"},{"fixed":"0ab152c6b5d95caa2dc1a30fa96e10258b5f188e"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","range":[{"introduced":"3.6.0"},{"fixed":"3.6.14"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","range":[{"introduced":"3.7.0"},{"fixed":"3.7.11"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","range":[{"introduced":"3.8.0"},{"fixed":"3.8.9"}]},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","range":[{"introduced":"3.9.0"},{"fixed":"3.9.3"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:python:python:3.10.0:-:*:*:*:*:*:*","range":[{"introduced":"3.10.0-NA"},{"last_affected":"3.10.0-NA"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"0ab152c6b5d95caa2dc1a30fa96e10258b5f188e"}]}]}}],"versions":["3.10.0-NA","v3.10.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-4189.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}