Critical Vulnerability in Python Package: CVE-2021-4189 - FTP Client Library Trust Issue
Summary
UBUNTU-CVE-2021-4189: A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. Affects python2.7 versions < 2.7.6-8ubuntu0.6+esm12. Fixed in 2.7.6-8ubuntu0.6+esm12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is extensively utilized in web development, data analysis, artificial intelligence, and more. The vulnerability in question affects the FTP client library within Python, specifically in passive mode, where it improperly trusts the host from the PASV response, leading to potential security risks.
Vulnerability Detail
A flaw was found in Python's FTP client library that affects its passive mode. The vulnerability arises from the library's default behavior of trusting the host from the PASV response. This can allow an attacker to set up a malicious FTP server that tricks clients into connecting to a specified IP address and port. The ramifications include unauthorized port scanning and potential exposure of sensitive data, as the FTP client may connect to unintended servers.
How To Fix
Minimum fixed version
2.7.6-8ubuntu0.6+esm12
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the FTP client library in passive mode until the package is updated. Alternatively, consider using secure file transfer protocols such as SFTP or FTPS that do not exhibit this vulnerability.
Conclusion
The CVE-2021-4189 vulnerability in Python's FTP client library poses a significant risk due to its flawed trust mechanism in passive mode. Users are urged to update their Python packages to the latest patched versions to mitigate this risk. In the meantime, utilizing secure file transfer protocols can serve as a temporary workaround.
See every vulnerability recorded for python2.7 →
FAQ
CVE-2021-4189 is a vulnerability in Python's FTP client library that allows an attacker to exploit the trust mechanism in passive mode, potentially leading to unauthorized connections.
The CVSS score for this vulnerability is 5.3, indicating a medium severity level that could lead to security risks if not addressed.
The vulnerability affects multiple versions of Python, including 2.7, 3.4, 3.5, 3.6, 3.7, and 3.8, particularly in their FTP client libraries.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider using secure alternatives to FTP or disabling the FTP client library's passive mode as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
