ZeroDay Findings
Sign inSign up

Findings

CVE-2021-4189

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode.

Published Aug 24, 2022 · updated Oct 14, 2026 · python python

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 24, 2022 · NIST NVD

    Detected

    A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports,

  2. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports,

Affected

  • cpe debian/debian linux10.0
  • cpe debian/debian linux11.0
  • cpe netapp/ontap select deploy administration utilityversion unspecified
  • cpe python/pythonversion unspecified
  • cpe python/python3.10.0
  • cpe redhat/software collectionsversion unspecified

Sources

  • CVE.orgCVE-2021-4189

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2021-4189

    A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP

    nvd.nist.gov

References