5.9
CVE-2026-8328
- EPSS 0.48%
- Veröffentlicht 13.05.2026 20:14:33
- Zuletzt bearbeitet 30.06.2026 16:16:56
- Quelle cna@python.org
- CVE-Watchlists
- Unerledigt
FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerPython Software Foundation
≫
Produkt
CPython
Default Statusunaffected
Version
0
Version <
3.13.14
Status
affected
Version
3.14.0
Version <
3.14.6
Status
affected
Version
3.15.0a1
Version <
3.15.0b2
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.48% | 0.376 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| cna@python.org | 5.9 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
CWE-918 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
https://github.com/python/cpython/issues/87451
https://github.com/python/cpython/pull/149648
https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/
https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06
https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0
https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763
https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d
https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9
https://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5f
https://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fceb