CVE-2021-4189

Aliases:DEBIAN-CVE-2021-4189
Advisory lineage Upstream: 0 Downstream: 28
Modified
Published: 24 Aug 2022, 00:00
Last modified:17 Dec 2025, 21:36

Vulnerability Summary

Overall Risk (default)
low
22/100
CVSS Score
5.3 MEDIUM
v3.1 (cve.org)
EPSS Score
3.2% LOW
3% probability +2.45%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

24 Aug 2022, 00:00
Published
Vulnerability first disclosed
17 Dec 2025, 21:36
Last Modified
Vulnerability information updated

Description

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Trends

Current EPSS score: 3.20%• Percentile: 88%

Techniques & Countermeasures

  • CWE-252•Unchecked Return Value

    The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Affected Systems

  • debian•pypy3

    < 7.3.5+dfsg-2 | < 7.3.5+dfsg-2 | < 7.3.5+dfsg-2 | < 7.3.5+dfsg-2

  • debian•python2.7

    all

  • debian•python3.9

    < 3.9.2-1+deb11u2

  • debian•debian_linux

    10.0 | 11.0

  • netapp•ontap_select_deploy_administration_utility

    na

  • python•python

    ≥ 3.6.0, < 3.6.14 | ≥ 3.7.0, < 3.7.11 | ≥ 3.8.0, < 3.8.9 | ≥ 3.9.0, < 3.9.3 | 3.10.0

  • redhat•enterprise_linux

    8.0

  • redhat•software_collections

    na

References (10)