CVE-2021-4189

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-25)

CWE

CWE-252

Published

2022-08-24

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• debian:debian_linux
• netapp:ontap_select_deploy_administration_utility
• python:python
• redhat:enterprise_linux
• redhat:software_collections

References

• https://access.redhat.com/security/cve/CVE-2021-4189
• https://bugs.python.org/issue43285
• https://bugzilla.redhat.com/show_bug.cgi?id=2036020
• https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e
• https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html

Check your stackJSON