Beveiligingsadvies

CVE-2026-8328

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-05-13 20:14:33

Laatst bijgewerkt 2026-08-13 00:26:54

Toegewezen door PSF

CVSS-score 5.9

Status PUBLISHED

Beschrijving

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.

← Alle CVE's bekijken Bekijk op cve.org ↗