Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
5 versions affected across 5 products
CVE-2026-8328 The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with t… https://www.cve.org/CVERecord?id=CVE-2026-8328
Post summary
The text merely notes that the ftpcp() function was omitted during a previous fix, referencing CVE-2026‑8328.
7 of 7 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 10.0 | - | - |
| OS | debian | debian_linux | 11.0 | - | - |
| App | netapp | ontap_select_deploy_administration_utility | - | - | - |
| App | python | python | - | - | - |
| App | python | python | 3.10.0 | - | - |
| OS | redhat | enterprise_linux | 8.0 | - | - |
| App | redhat | software_collections | - | - | - |