AZL-86913
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-86913.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-86913
- Upstream
- Published
- 2026-05-13T21:16:50Z
- Modified
- 2026-08-30T05:26:50Z
- Summary
- CVE-2026-8328 affecting package python3 for versions less than 3.12.9-13
- Details
-
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
- References