PSF-2021-5

    Dashboard / Vulnerabilities / PSF-2021-5

    PSF-2021-5

    Published: 21 Feb 2021Last Modified: 9 Oct 2025

    Summary: ftplib should not use the host from the PASV response

    Details: The IPv4 address value returned from the server in response to the PASV command should not be trusted. This prevents a malicious FTP server from using the response to probe IPv4 address and port combinations on the client network. Instead of using the returned address, we use the IP address we're already connected to. This is the strategy other ftp clients adopted, and matches the only strategy available for the modern IPv6 EPSV command where the server response must return a port number and nothing else.

    References: https://hackerone.com/reports/1040166, https://bugs.python.org/issue43285

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -0ab152c6b5d95caa2dc1a30fa96e10258b5f188e

    Affected versions

    2.5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PSF-2021-5 | CVE-DB