This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-8328 →

ALPINE-CVE-2026-8328

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV hos...

Original description

The description as published by the source.

The ftpcp() function in Lib/ftplib.py was not updated when
CVE-2021-4189 was fixed. While makepasv() was patched to replace
server-supplied PASV host addresses with the actual peer address
(getpeername()[0]), ftpcp() still calls parse227() directly and passes
the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Alpine:v3.24 python3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.7-r0"}]}]

References

advisory security.alpinelinux.org