CVE-2021-4189Medium· 5.3▾ SunlitA flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.6 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
3.2%
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
python >= 3.6.0, < 3.6.14python >= 3.7.0, < 3.7.11python >= 3.8.0, < 3.8.9python >= 3.9.0, < 3.9.3python = 3.10.0debian_linux = 10.0debian_linux = 11.0software_collectionsenterprise_linux = 8.0ontap_select_deploy_administration_utilityUpgrade past the affected range:
python 3.9.3Connected by shared product, vendor, weakness, or advisory.
CVE-2021-3737High· 7.5A flaw was found in python
CVE-2021-3426Medium· 5.7There's a flaw in Python 3's pydoc
CVE-2021-3177Critical· 9.8Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300…
CVE-2021-3733Medium· 6.5There's a flaw in urllib's AbstractBasicAuthHandler class
CVE-2020-26116High· 7.2http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in…
CVE-2015-20107High· 7.6In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file