---
id: CVE-2021-4189
title: >-
  A flaw was found in Python, specifically in the FTP (File Transfer Protocol)
  client library in PASV (passive) mode
summary: >-
  A flaw was found in Python, specifically in the FTP (File Transfer Protocol)
  client library in PASV (passive) mode. The issue is how the FTP client trusts
  the host from the PASV response by default. This flaw allows an attacker to
  set up…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-252
  - CWE-252
vendor: python
product: python
affected:
  - 'python >= 3.6.0, < 3.6.14'
  - 'python >= 3.7.0, < 3.7.11'
  - 'python >= 3.8.0, < 3.8.9'
  - 'python >= 3.9.0, < 3.9.3'
  - python = 3.10.0
  - debian_linux = 10.0
  - debian_linux = 11.0
  - software_collections
  - enterprise_linux = 8.0
  - ontap_select_deploy_administration_utility
patched:
  - python 3.9.3
published: '2022-08-24'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T11:16:54.940'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-4189'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2021-4189'
    label: secalert@redhat.com
  - url: 'https://bugs.python.org/issue43285'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2036020'
    label: secalert@redhat.com
  - url: >-
      https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e
    label: secalert@redhat.com
  - url: 'https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html'
    label: secalert@redhat.com
  - url: 'https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html'
    label: secalert@redhat.com
  - url: 'https://python-security.readthedocs.io/vuln/ftplib-pasv.html'
    label: secalert@redhat.com
  - url: 'https://security-tracker.debian.org/tracker/CVE-2021-4189'
    label: secalert@redhat.com
  - url: 'https://security.netapp.com/advisory/ntap-20221104-0004/'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2021-4189'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugs.python.org/issue43285'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2036020'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://python-security.readthedocs.io/vuln/ftplib-pasv.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security-tracker.debian.org/tracker/CVE-2021-4189'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20221104-0004/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.03196
epssPercentile: 0.87806
ingestedAt: '2026-10-14T11:27:22.128Z'
---

## Overview

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

## Affected

- `python >= 3.6.0, < 3.6.14`
- `python >= 3.7.0, < 3.7.11`
- `python >= 3.8.0, < 3.8.9`
- `python >= 3.9.0, < 3.9.3`
- `python = 3.10.0`
- `debian_linux = 10.0`
- `debian_linux = 11.0`
- `software_collections`
- `enterprise_linux = 8.0`
- `ontap_select_deploy_administration_utility`

## Remediation

Upgrade past the affected range:

- `python 3.9.3`