Skip to content

ftplib should not use the host from the PASV response #87451

Closed
Closed
ftplib should not use the host from the PASV response#87451
Labels
3.7 (EOL)end of lifestdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Description

@ricexdream
ricexdream
mannequin
opened on Feb 21, 2021
BPO 43285
Nosy @gpshead, @giampaolo, @ned-deily, @miss-islington
PRs
  • bpo-43285 Make ftplib not trust the PASV response. #24838
  • [3.9] bpo-43285 Make ftplib not trust the PASV response. (GH-24838) #24880
  • [3.8] bpo-43285 Make ftplib not trust the PASV response. (GH-24838) #24881
  • [3.6] bpo-43285 Make ftplib not trust the PASV response. (GH-24838) (GH-24881) #24882
  • [3.7] bpo-43285 Make ftplib not trust the PASV response. (GH-24838) (GH-24881) #24883
  • bpo-43285: Whats New entry for 3.8.9. #24886
  • bpo-43285: Add a What's New entry for 3.9.3. #24887
  • [3.9] bpo-43285: Add a What's New entry for 3.9.3. #24888
  • [3.8] bpo-43285: Whats New entry for 3.8.9. #24889
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2021-03-16.21:54:25.203>
created_at = <Date 2021-02-21.11:49:34.689>
labels = ['type-security', '3.7', 'library', 'release-blocker']
title = 'ftplib should not use the host from the PASV response'
updated_at = <Date 2021-03-16.21:54:25.202>
user = 'https://bugs.python.org/ricexdream'

    bugs.python.org fields:

    activity = <Date 2021-03-16.21:54:25.202>
actor = 'ned.deily'
assignee = 'none'
closed = True
closed_date = <Date 2021-03-16.21:54:25.203>
closer = 'ned.deily'
components = ['Library (Lib)']
creation = <Date 2021-02-21.11:49:34.689>
creator = 'ricexdream'
dependencies = []
files = []
hgrepos = []
issue_num = 43285
keywords = ['patch']
message_count = 16.0
messages = ['387455', '388267', '388602', '388610', '388757', '388761', '388762', '388763', '388768', '388777', '388812', '388813', '388815', '388882', '388885', '388891']
nosy_count = 5.0
nosy_names = ['gregory.p.smith', 'giampaolo.rodola', 'ned.deily', 'miss-islington', 'ricexdream']
pr_nums = ['24838', '24880', '24881', '24882', '24883', '24886', '24887', '24888', '24889']
priority = 'release blocker'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue43285'
versions = ['Python 3.6', 'Python 3.7']

    Linked PRs

    Activity

    1. ricexdream commented on Feb 21, 2021

      @ricexdream
      ricexdreammannequin
      on Feb 21, 2021
      MannequinAuthor

      Last year, curl had a security update for CVE-2020-8284. more info, see https://hackerone.com/reports/1040166

      The problem is ftp client trust the host from PASV response by default, A malicious server can trick ftp client into connecting
      back to a given IP address and port. This may make ftp client scan ports and extract service banner from private newwork.

      After test and read ftplib module(

      cpython/Lib/ftplib.py

      Line 346 in 6329893

      host, port = self.makepasv()
      ), I found ftplib has the same problem.

    2. ricexdream
      added
      3.9 (EOL)end of life
      stdlibStandard Library Python modules in the Lib/ directory
      type-securityA security issue
      on Feb 21, 2021

    3. ricexdream commented on Mar 8, 2021

      @ricexdream
      ricexdreammannequin
      on Mar 8, 2021
      MannequinAuthor

      Any response here? If you need more information let me know.

    4. gpshead commented on Mar 13, 2021

      @gpshead
      gpshead
      on Mar 13, 2021
      Member

      Indeed, the host on that line there should just be ignored with the IP address of the original data connection used in its place.

      Your https://hackerone.com/reports/1040166 link provides plenty of information and likes to prior art mitigations other ftp clients including Firefox and Chrome well over a decade ago.

    5. gpshead
      added
      3.7 (EOL)end of life
      3.8 (EOL)end of life
      3.10 (EOL)end of life
      on Mar 13, 2021
    6. gpshead
      self-assigned this
      on Mar 13, 2021
    7. gpshead
      added
      3.7 (EOL)end of life
      3.8 (EOL)end of life
      on Mar 13, 2021

    8. 40 remaining items

    9. gpshead
      added 5 commits that reference this issue on May 13, 2026

      pythongh-87451: Use unittest.mock instead of hand-written fakes in ft…

      917aad9

      gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648)

      eac4fe3

      [3.13] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…

      bb3446d

      [3.14] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…

      7d95a1d

      [3.15] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…

      5dadc64
    10. Yhg1s
      added a commit that references this issue on May 18, 2026

      [3.12] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…

      c887044
    11. pablogsal
      added 2 commits that reference this issue on Jun 27, 2026

      [3.11] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…

      ef12d0d

      [3.10] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-1…

      2bbcf3f
    12. mcepl
      added 4 commits that reference this issue on Sep 18, 2026

      [CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()

      37e0716

      [CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()

      6956517

      [CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()

      fc179ad

      [CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()

      5369b14
    13. mcepl
      added 3 commits that reference this issue on Oct 1, 2026

      [CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()

      4c25afa

      [CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()

      d91b9e4

      [CVE-2026-8328] Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()

      b0c0c26
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      3.7 (EOL)end of lifestdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

      Projects

      No projects

        Milestone

        No milestone

        Relationships

        None yet

        Development

        No branches or pull requests

        Issue actions