Re: [LFS Trac] #5934: Fix CVE-2026-7210 and CVE-2021-4189 in Python (was: Fix CVE-2026-7210 in Python)

#5934: Fix CVE-2026-7210 and CVE-2021-4189 in Python
-----------------------------+-----------------------
 Reporter:  Douglas R. Reno  |       Owner:  lfs-book
     Type:  enhancement      |      Status:  new
 Priority:  high             |   Milestone:  13.1
Component:  Book             |     Version:  git
 Severity:  normal           |  Resolution:
 Keywords:                   |
-----------------------------+-----------------------
Changes (by Joe Locash):

 * summary:  Fix CVE-2026-7210 in Python => Fix CVE-2026-7210 and
     CVE-2021-4189 in Python

Comment:

 {{{
 Subject: [Security-announce][CVE-2026-8328] FTP PASV SSRF,
  ftpcp() does not use actual peer address,
  trusts server-supplied PASV host address
 Date: Wed, 13 May 2026 20:15:52 +0000
 From: Seth Larson <[email protected]>
 Reply-To: [email protected]
 To: [email protected]

 There is a MEDIUM severity vulnerability affecting CPython.

 The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189
 was fixed. While makepasv() was patched to replace server-supplied PASV
 host addresses with the actual peer address (getpeername()[0]), ftpcp()
 still calls parse227() directly and passes the raw attacker-controllable
 IP
 address and port to target.sendport().

 Please see the linked CVE ID for the latest information on affected
 versions:

 * https://www.cve.org/CVERecord?id=CVE-2026-8328
 * https://github.com/python/cpython/pull/149648
 }}}
 Upstream PR for the 3.14 branch:
 https://github.com/python/cpython/pull/149793 (merged)
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/5934#comment:2>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page