Cette page suit l'état du correctif pour Alpine Linux. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-8328 →

ALPINE-CVE-2026-8328

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV hos...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

The ftpcp() function in Lib/ftplib.py was not updated when
CVE-2021-4189 was fixed. While makepasv() was patched to replace
server-supplied PASV host addresses with the actual peer address
(getpeername()[0]), ftpcp() still calls parse227() directly and passes
the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Alpine:v3.24 python3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.7-r0"}]}]

Références

advisory security.alpinelinux.org