ALPINE-CVE-2026-8328

ALPINE-CVE-2026-8328

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.

CVSS 5.9 · Medium · Fix available

Published

2026-05-13T21:16:50.167Z

Updated

2026-10-01T02:17:49.416055600Z

Stack: system

Check your server →