CVE-2021-37533: Apache Commons Net's FTP client trusts the host from PASV response by default
First published: Sat Dec 03 2022(Updated: )
Apache Commons Net could allow a remote attacker to obtain sensitive information, caused by an issue with the FTP client trusts the host from PASV response by default. By persuading a victim to connect to specially-crafted server, an attacker could exploit this vulnerability to obtain information about services running on the private network, and use this information to launch further attacks against the affected system.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/libcommons-net-java | <=3.6-1 | 3.6-1+deb10u1 3.6-1+deb11u1 3.9.0-1 |
| Apache Commons Net | <3.9.0 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| redhat/apache-commons-net | <3.9.0 | 3.9.0 |
| IBM IBM® Engineering Requirements Management DOORS | <=9.7.2.7 | |
| IBM IBM® Engineering Requirements Management DOORS Web Access | <=9.7.2.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2021-37533 https://nvd.nist.gov/vuln/detail/CVE-2021-37533
- https://bugzilla.redhat.com/show_bug.cgi?id=2169924
- https://access.redhat.com/errata/RHSA-2023:3667
- https://access.redhat.com/errata/RHSA-2023:2100
- https://access.redhat.com/security/cve/cve-2021-37533
- https://issues.apache.org/jira/browse/NET-711
- https://security-tracker.debian.org/tracker/CVE-2021-37533
- https://www.cve.org/CVERecord?id=CVE-2021-37533
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1025910
- https://lists.apache.org/thread/o6yn9r9x6s94v97264hmgol1sf48mvx7
- https://github.com/apache/commons-net/commit/b0bff89f70cfea70009e22f87639816cc3993974
- http://www.openwall.com/lists/oss-security/2022/12/03/1
- https://lists.debian.org/debian-lts-announce/2022/12/msg00038.html
- https://www.debian.org/security/2022/dsa-5307
- https://exchange.xforce.ibmcloud.com/vulnerabilities/241253
- https://www.ibm.com/support/pages/node/7124058
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-37533.
What is the severity of CVE-2021-37533?
The severity of CVE-2021-37533 is medium with a CVSS score of 6.5.
What is the affected software by CVE-2021-37533?
The affected software includes Apache Commons Net version up to and exclusive of 3.9.0 and IBM Disconnected Log Collector versions up to and inclusive of v1.0 - v1.8.2.
How does CVE-2021-37533 work?
CVE-2021-37533 allows a malicious server to redirect the Apache Commons Net code to use a different host, potentially leading to information leakage.
How can I fix CVE-2021-37533?
To fix CVE-2021-37533, update to Apache Common Net version 3.9.0 or later.
- collector/redhat-cve
- collector/debian-bugs
- alias/CVE-2021-37533
- collector/security-tracker-debian
- collector/nvd-index
- agent/type
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/references
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- collector/ibm-support
- source/IBM
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/tags
- package-manager/debian
- vendor/apache
- canonical/apache commons net
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- package-manager/redhat
- vendor/ibm
- canonical/ibm cognos command center
- version/ibm cognos command center/10.2.4.1