{"id":"CVE-2026-8328","title":"The ftpcp() function in Lib/ftplib.py was not updated when \nCVE-2021-4189 was fixed","summary":"The ftpcp() function in Lib/ftplib.py was not updated when \nCVE-2021-4189 was fixed. While makepasv() was patched to replace \nserver-supplied PASV host addresses with the actual peer address \n(getpeername()[0]), ftpcp() still calls parse…","severity":"medium","cwe":["CWE-918","CWE-807"],"published":"2026-05-13","updated":"2026-06-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8328","references":[{"url":"https://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5f","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fceb","label":"cna@python.org"},{"url":"https://github.com/python/cpython/issues/87451","label":"cna@python.org"},{"url":"https://github.com/python/cpython/pull/149648","label":"cna@python.org"},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/","label":"cna@python.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8328.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-8328"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477300"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8328"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8328"},{"url":"https://access.redhat.com/errata/RHSA-2026:67572"},{"url":"https://access.redhat.com/errata/RHSA-2026:68132"},{"url":"https://access.redhat.com/errata/RHSA-2026:68135"},{"url":"https://access.redhat.com/errata/RHSA-2026:68154"},{"url":"https://access.redhat.com/errata/RHSA-2026:68309"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00457,"epssPercentile":0.38865,"ingestedAt":"2026-07-01T09:50:45.590Z","vendor":"Red Hat","product":"Red Hat Hardened Images","affected":["hardened_images"],"cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"vendor","patched":["hardened_images"],"slug":"CVE-2026-8328","body":"## Overview\n\nThe ftpcp() function in Lib/ftplib.py was not updated when \nCVE-2021-4189 was fixed. While makepasv() was patched to replace \nserver-supplied PASV host addresses with the actual peer address \n(getpeername()[0]), ftpcp() still calls parse227() directly and passes \nthe raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8328.json)\n- **RHSA-2026:67572** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67572)\n- **RHSA-2026:68132** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68132)\n- **RHSA-2026:68135** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68135)\n- **RHSA-2026:68154** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68154)\n- **RHSA-2026:68309** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68309)","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":206923,"id":"CVE-2026-8328","ts":1789749703007,"field":"cvss","old":null,"new":"5.3"},{"seq":206922,"id":"CVE-2026-8328","ts":1789749703007,"field":"severity","old":"none","new":"medium"}]}