Description

assignee = None
closed_at = <Date 2021-03-16.21:54:25.203>
created_at = <Date 2021-02-21.11:49:34.689>
labels = ['type-security', '3.7', 'library', 'release-blocker']
title = 'ftplib should not use the host from the PASV response'
updated_at = <Date 2021-03-16.21:54:25.202>
user = 'https://bugs.python.org/ricexdream'

activity = <Date 2021-03-16.21:54:25.202>
actor = 'ned.deily'
assignee = 'none'
closed = True
closed_date = <Date 2021-03-16.21:54:25.203>
closer = 'ned.deily'
components = ['Library (Lib)']
creation = <Date 2021-02-21.11:49:34.689>
creator = 'ricexdream'
dependencies = []
files = []
hgrepos = []
issue_num = 43285
keywords = ['patch']
message_count = 16.0
messages = ['387455', '388267', '388602', '388610', '388757', '388761', '388762', '388763', '388768', '388777', '388812', '388813', '388815', '388882', '388885', '388891']
nosy_count = 5.0
nosy_names = ['gregory.p.smith', 'giampaolo.rodola', 'ned.deily', 'miss-islington', 'ricexdream']
pr_nums = ['24838', '24880', '24881', '24882', '24883', '24886', '24887', '24888', '24889']
priority = 'release blocker'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue43285'
versions = ['Python 3.6', 'Python 3.7']

Activity

1. ricexdream commented on Feb 21, 2021

   

   ricexdreammannequin

   on Feb 21, 2021

   MannequinAuthor

   More actions

   Last year, curl had a security update for CVE-2020-8284. more info, see https://hackerone.com/reports/1040166

   The problem is ftp client trust the host from PASV response by default, A malicious server can trick ftp client into connecting
   back to a given IP address and port. This may make ftp client scan ports and extract service banner from private newwork.

   After test and read ftplib module(

   cpython/Lib/ftplib.py

   Line 346 in 6329893

   host, port = self.makepasv()

   ), I found ftplib has the same problem.
2. ricexdream

   added

   3.9 (EOL)end of lifeend of life

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   type-securityA security issueA security issue

   on Feb 21, 2021
3. ricexdream commented on Mar 8, 2021

   

   ricexdreammannequin

   on Mar 8, 2021

   MannequinAuthor

   More actions

   Any response here? If you need more information let me know.
4. gpshead commented on Mar 13, 2021

   

   gpshead

   on Mar 13, 2021

   Member

   More actions

   Indeed, the host on that line there should just be ignored with the IP address of the original data connection used in its place.

   Your https://hackerone.com/reports/1040166 link provides plenty of information and likes to prior art mitigations other ftp clients including Firefox and Chrome well over a decade ago.
5. gpshead

   added

   3.7 (EOL)end of lifeend of life

   3.8 (EOL)end of lifeend of life

   3.10 (EOL)end of lifeend of life

   on Mar 13, 2021
6. gpshead

   self-assigned this

   on Mar 13, 2021
7. gpshead

   added

   3.7 (EOL)end of lifeend of life

   3.8 (EOL)end of lifeend of life

   on Mar 13, 2021
8. 41 remaining items
9. gpshead

   added 4 commits that reference this issue on May 13, 2026

   gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648)

   eac4fe3

   [3.13] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…

   bb3446d

   [3.14] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…

   7d95a1d

   [3.15] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…

   5dadc64
10. Yhg1s

    added a commit that references this issue on May 18, 2026

    [3.12] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…

    c887044
11. pablogsal

    added 2 commits that reference this issue on Jun 27, 2026

    [3.11] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…

    ef12d0d

    [3.10] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…

    2bbcf3f
12. mcepl

    added 4 commits that reference this issue on Sep 18, 2026

    [CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()

    37e0716

    [CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()

    6956517

    [CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()

    fc179ad

    [CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()

    5369b14
13. mcepl

    added 3 commits that reference this issue on Oct 1, 2026

    [CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()

    4c25afa

    [CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()

    d91b9e4

    [CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()

    b0c0c26
14. icanhasmath

    added a commit that references this issue on Oct 28, 2026

    [3.10] pythongh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (…

    7ff917f

Issue actions