Repository navigation
ftplib should not use the host from the PASV response #87451
Description
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = <Date 2021-03-16.21:54:25.203>
created_at = <Date 2021-02-21.11:49:34.689>
labels = ['type-security', '3.7', 'library', 'release-blocker']
title = 'ftplib should not use the host from the PASV response'
updated_at = <Date 2021-03-16.21:54:25.202>
user = 'https://bugs.python.org/ricexdream'bugs.python.org fields:
activity = <Date 2021-03-16.21:54:25.202>
actor = 'ned.deily'
assignee = 'none'
closed = True
closed_date = <Date 2021-03-16.21:54:25.203>
closer = 'ned.deily'
components = ['Library (Lib)']
creation = <Date 2021-02-21.11:49:34.689>
creator = 'ricexdream'
dependencies = []
files = []
hgrepos = []
issue_num = 43285
keywords = ['patch']
message_count = 16.0
messages = ['387455', '388267', '388602', '388610', '388757', '388761', '388762', '388763', '388768', '388777', '388812', '388813', '388815', '388882', '388885', '388891']
nosy_count = 5.0
nosy_names = ['gregory.p.smith', 'giampaolo.rodola', 'ned.deily', 'miss-islington', 'ricexdream']
pr_nums = ['24838', '24880', '24881', '24882', '24883', '24886', '24887', '24888', '24889']
priority = 'release blocker'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue43285'
versions = ['Python 3.6', 'Python 3.7']Linked PRs
- gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() #149648
- [3.15] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648) #149792
- [3.14] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648) #149793
- [3.13] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648) #149794
- [3.12] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648) #149795
- [3.11] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648) #149796
- [3.10] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648) #149797
Activity
ricexdream commented on Feb 21, 2021
Last year, curl had a security update for CVE-2020-8284. more info, see https://hackerone.com/reports/1040166
The problem is ftp client trust the host from PASV response by default, A malicious server can trick ftp client into connecting
back to a given IP address and port. This may make ftp client scan ports and extract service banner from private newwork.
After test and read ftplib module(
cpython/Lib/ftplib.py
Line 346 in 6329893
ricexdream commented on Mar 8, 2021
Any response here? If you need more information let me know.
gpshead commented on Mar 13, 2021
Indeed, the host on that line there should just be ignored with the IP address of the original data connection used in its place.
Your https://hackerone.com/reports/1040166 link provides plenty of information and likes to prior art mitigations other ftp clients including Firefox and Chrome well over a decade ago.
40 remaining items
pythongh-87451: Use unittest.mock instead of hand-written fakes in ft…
gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648)
[3.13] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…
[3.14] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…
[3.15] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…
[3.12] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…
[3.11] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…
[3.10] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…
[CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()
[CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()
[CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()
[CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()
[CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()
[CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()
[CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()