---
id: CVE-2026-8328
title: |-
  The ftpcp() function in Lib/ftplib.py was not updated when 
  CVE-2021-4189 was fixed
summary: |-
  The ftpcp() function in Lib/ftplib.py was not updated when 
  CVE-2021-4189 was fixed. While makepasv() was patched to replace 
  server-supplied PASV host addresses with the actual peer address 
  (getpeername()[0]), ftpcp() still calls parse…
severity: medium
cwe:
  - CWE-918
  - CWE-807
published: '2026-05-13'
updated: '2026-06-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8328'
references:
  - url: >-
      https://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5f
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fceb
    label: cna@python.org
  - url: 'https://github.com/python/cpython/issues/87451'
    label: cna@python.org
  - url: 'https://github.com/python/cpython/pull/149648'
    label: cna@python.org
  - url: >-
      https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/
    label: cna@python.org
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8328.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-8328'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2477300'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-8328'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8328'
  - url: 'https://access.redhat.com/errata/RHSA-2026:67572'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68132'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68135'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68154'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68309'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00457
epssPercentile: 0.38996
ingestedAt: '2026-07-01T09:50:45.590Z'
vendor: Red Hat
product: Red Hat Hardened Images
affected:
  - hardened_images
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: vendor
patched:
  - hardened_images
---

## Overview

The ftpcp() function in Lib/ftplib.py was not updated when 
CVE-2021-4189 was fixed. While makepasv() was patched to replace 
server-supplied PASV host addresses with the actual peer address 
(getpeername()[0]), ftpcp() still calls parse227() directly and passes 
the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8328.json)
- **RHSA-2026:67572** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67572)
- **RHSA-2026:68132** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68132)
- **RHSA-2026:68135** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68135)
- **RHSA-2026:68154** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68154)
- **RHSA-2026:68309** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68309)