ALPINE-CVE-2026-8328

ALPINE-CVE-2026-8328

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.

CVSS 5.9 · Media · Corrección disponible

Publicación

2026-05-13T21:16:50.167Z

Actualización

2026-10-01T02:17:49.416055600Z

Pila tecnológica: system

Comprueba tu servidor →