CVE-2021-4189
First published: Tue Dec 21 2021(Updated: )
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/python3 | <0:3.6.8-45.el8 | 0:3.6.8-45.el8 |
| redhat/rh-python38-babel | <0:2.7.0-12.el7 | 0:2.7.0-12.el7 |
| redhat/rh-python38-python | <0:3.8.11-2.el7 | 0:3.8.11-2.el7 |
| redhat/rh-python38-python-cryptography | <0:2.8-5.el7 | 0:2.8-5.el7 |
| redhat/rh-python38-python-jinja2 | <0:2.10.3-6.el7 | 0:2.10.3-6.el7 |
| redhat/rh-python38-python-lxml | <0:4.4.1-7.el7 | 0:4.4.1-7.el7 |
| redhat/rh-python38-python-pip | <0:19.3.1-2.el7 | 0:19.3.1-2.el7 |
| redhat/rh-python38-python-urllib3 | <0:1.25.7-7.el7 | 0:1.25.7-7.el7 |
| redhat/python27-python | <0:2.7.18-4.el7 | 0:2.7.18-4.el7 |
| Python Python | >=3.6.0<3.6.14 | |
| Python Python | >=3.7.0<3.7.11 | |
| Python Python | >=3.8.0<3.8.9 | |
| Python Python | >=3.9.0<3.9.3 | |
| Python Python | =3.10.0 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| Redhat Software Collections | ||
| Redhat Enterprise Linux | =8.0 | |
| NetApp ONTAP Select Deploy administration utility | ||
| redhat/python | <3.6.14 | 3.6.14 |
| redhat/python | <3.7.11 | 3.7.11 |
| redhat/python | <3.8.9 | 3.8.9 |
| redhat/python | <3.9.3 | 3.9.3 |
| redhat/python | <3.10.0 | 3.10.0 |
| IBM Cloud Pak for Security | <=1.10.0.0 - 1.10.11.0 | |
| IBM QRadar Suite Software | <=1.10.12.0 - 1.10.16.0 | |
| debian/pypy3 | <=7.3.5+dfsg-2+deb11u2<=7.3.5+dfsg-2+deb11u3 | 7.3.11+dfsg-2+deb12u2 7.3.17+dfsg-2 |
| debian/python2.7 | <=2.7.18-8+deb11u1 | |
| debian/python3.9 | <=3.9.2-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2021-4189 https://nvd.nist.gov/vuln/detail/CVE-2021-4189 https://bugs.python.org/issue43285
- https://bugzilla.redhat.com/show_bug.cgi?id=2036020
- https://access.redhat.com/errata/RHSA-2022:1821
- https://access.redhat.com/errata/RHSA-2022:1986
- https://access.redhat.com/errata/RHSA-2021:3254
- https://access.redhat.com/errata/RHSA-2022:1663
- https://access.redhat.com/security/cve/cve-2021-4189
- https://access.redhat.com/security/cve/CVE-2021-4189
- https://bugs.python.org/issue43285
- https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
- https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
- https://python-security.readthedocs.io/vuln/ftplib-pasv.html
- https://security-tracker.debian.org/tracker/CVE-2021-4189
- https://security.netapp.com/advisory/ntap-20221104-0004/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2036021
- https://launchpad.net/bugs/cve/CVE-2021-4189
- https://exchange.xforce.ibmcloud.com/vulnerabilities/227269
- https://www.ibm.com/support/pages/node/7080058 (Advisory)
- https://github.com/python/cpython/commit/7dcb4baa4f0fde3aef5122a8e9f6a41853ec9335
- https://github.com/python/cpython/commit/79373951b3eab585d42e0f0ab83718cbe1d0ee33
- https://github.com/python/cpython/commit/4134f154ae2f621f25c5d698cc0f1748035a1b88
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4189
- https://nvd.nist.gov/vuln/detail/CVE-2021-4189
- https://ubuntu.com/security/CVE-2021-4189
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2021-4189?
CVE-2021-4189 is a vulnerability found in Python's FTP (File Transfer Protocol) client library in PASV (passive) mode.
How does the vulnerability in CVE-2021-4189 affect Python?
The vulnerability in CVE-2021-4189 allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting to it.
What is the severity level of CVE-2021-4189?
The severity level of CVE-2021-4189 is medium, with a CVSS score of 5.3.
Which versions of Python are affected by CVE-2021-4189?
The versions affected by CVE-2021-4189 are Python 3.6.14, Python 3.7.11, Python 3.8.9, Python 3.9.3, and Python 3.10.0.
How can I fix the vulnerability in Python identified as CVE-2021-4189?
To fix the vulnerability in Python identified as CVE-2021-4189, you should update to Python versions 3.6.14, 3.7.11, 3.8.9, 3.9.3, or 3.10.0, depending on the version you are currently using.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-4189
- agent/software-canonical-lookup
- agent/remedy
- agent/description
- collector/nvd-cve
- source/NVD
- agent/author
- agent/references
- collector/launchpad-cve
- source/Launchpad
- collector/ibm-support
- source/IBM
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- package-manager/redhat
- vendor/python
- canonical/python python
- version/python python/3.6.0
- version/python python/3.7.0
- version/python python/3.8.0
- version/python python/3.9.0
- version/python python/3.10.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- vendor/redhat
- canonical/redhat software collections
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- vendor/netapp
- canonical/netapp ontap select deploy administration utility
- vendor/ibm
- canonical/ibm cloud pak for security
- version/ibm cloud pak for security/1.10.0.0 - 1.10.11.0
- canonical/ibm qradar suite software
- version/ibm qradar suite software/1.10.12.0 - 1.10.16.0
- package-manager/debian