CVE-2021-4189
Python vulnerabilities
Description
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
Metrics
Affected operating systems
linux
debian / debian_linux10.0
linux
debian / debian_linux11.0
linux
redhat / enterprise_linux8.0
linux
ubuntu / python2.7bionic
linux
ubuntu / python2.7focal
linux
ubuntu / python2.7jammy
linux
ubuntu / python2.7trusty
linux
ubuntu / python2.7xenial
linux
ubuntu / python3.10jammy
linux
ubuntu / python3.11jammy
linux
ubuntu / python3.12noble
linux
ubuntu / python3.14resolute
linux
ubuntu / python3.4trusty
linux
ubuntu / python3.5trusty
linux
ubuntu / python3.5xenial
linux
ubuntu / python3.6bionic
linux
ubuntu / python3.7bionic
linux
ubuntu / python3.8bionic
linux
ubuntu / python3.8focal
linux
ubuntu / python3.9focal
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
bitnami
python-min3.10.0
bitnami
python-min3.11.0
bitnami
python-min3.12.0
bitnami
python-min3.13.0
bitnami
python-min3.14.0
bitnami
python-min3.6.0
bitnami
python-min3.7.0
bitnami
python-min3.8.0
bitnami
python-min3.9.0
python
python3.14.0 – 3.14.4
python
python3.13.13
python
python
python-markdown
markdown
References & sources
- https://github.com/python/cpython/issues/145506report
- https://github.com/python/cpython/pull/145507web
- https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603efix
- https://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535efix
- https://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86fix
- https://github.com/python/cpython/commit/69ddd9bb2cc4bd69b1565647c18659c6a789ccd9fix
- https://github.com/python/cpython/commit/876858c9f65d9ab656c7fa639f268ce7856d89ddfix
- https://github.com/python/cpython/commit/c70adad78caeeea33f92f560ecb93331ca11bf66patch
- http://www.openwall.com/lists/oss-security/2026/03/05/6
- https://github.com/python/cpython/pull/146212web
- https://github.com/python/cpython/issues/146211report
- https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/advisory
- https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69fix
- https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2edfix
- https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8ddfix
- https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ecfix
- https://github.com/python/cpython/commit/56b7100b04e44ea27989242b176beb8f016b2c53fix
- https://github.com/python/cpython/commit/58703ec1bdd1eb075e8b01a0c427683ce594dd3efix
- http://www.openwall.com/lists/oss-security/2026/04/11/4
- https://nvd.nist.gov/vuln/detail/CVE-2026-1502web
Linked CVEs
- CVE-2026-9669
bz2.BZ2Decompressor objects could be reused after a decompression error.
high - CVE-2026-8328
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed.
medium - CVE-2026-7774
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect late…
medium - CVE-2026-6100
A flaw was found in Python's decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`.
criticalCVSSv3 8.1 - CVE-2026-6019
A flaw was found in Python's `http.cookies` module.
mediumCVSSv3 6.1 - CVE-2026-5713
A flaw was found in Python.
medium - CVE-2026-4786
A flaw was found in the Python webbrowser.open() API.
highCVSSv3 7.1 - CVE-2026-4519
A flaw was found in Python.
highCVSSv3 7.1 - CVE-2026-4224
A stack overflow flaw has been discovered in the python pyexpat module.
highCVSSv3 7.5 - CVE-2026-3644
A control character validation flaw has been discovered in the Python http.cookie module.
highCVSSv3 7.5 - CVE-2026-3276
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining cha…
medium - CVE-2026-2297
A flaw was found in CPython.
medium - CVE-2026-1502
A flaw was found in Python.
medium - CVE-2026-1299
A flaw was found in the email module in the Python standard library.
medium - CVE-2026-0672
An injection flaw has been discovered in Python.
medium - CVE-2025-69534
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unha…
highCVSSv3 7.5 - CVE-2025-13462
A flaw was found in the `tarfile` module of cpython.
lowCVSSv3 3.3