Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 07:37:21 +0000 CVE-2026-8328 — FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address https://vulnerability.circl.lu/vuln/cve-2026-8328 <p><strong>Affected:</strong> Python Software Foundation CPython</p> <p>The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.</p> <p><strong>Affected:</strong> Python Software Foundation CPython</p> <p>The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.</p> https://vulnerability.circl.lu/vuln/cve-2026-8328