gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() by gpshead · Pull Request #149648 · python/cpython

gpshead · 2026-05-10T18:21:21Z

ftpcp() called parse227() directly and passed the source server's self-reported PASV IPv4 address to the target server's PORT command, bypassing the CVE-2021-4189 fix that was applied only to FTP.makepasv(). A malicious source FTP server could use this to redirect the target server's data connection to an arbitrary host:port (SSRF).

ftpcp() now uses the source server's actual peer address, honoring the existing trust_server_pasv_ipv4_address opt-out, the same as makepasv().

Thanks to Qi Deng at Aurascape AI for the report. (GHSA-w8c5-q2xf-gf7c)

Issue: ftplib should not use the host from the PASV response #87451

ftpcp() called parse227() directly and passed the source server's self-reported PASV IPv4 address to the target server's PORT command, bypassing the CVE-2021-4189 fix that was applied only to FTP.makepasv(). A malicious source FTP server could use this to redirect the target server's data connection to an arbitrary host:port (SSRF). ftpcp() now uses the source server's actual peer address, honoring the existing trust_server_pasv_ipv4_address opt-out, the same as makepasv(). Thanks to Qi Ding (AKA ikow) for the report.

read-the-docs-community · 2026-05-10T18:24:58Z

Documentation build overview

📚 cpython-previews | 🛠️ Build #32625809 | 📁 Comparing 3be7f40 against main (a8e3247)

🔍 Preview build

102 files changed · ± 99 modified · - 3 deleted

±Modified

-Deleted

…pcp test Replace the _Fake* helper classes in TestFtpcpSecurity with mock.Mock objects spec'd against ftplib.FTP. The spec gives a real-API check that ftpcp() only touches attributes that exist on FTP, and a keyword-only _make_pair() helper keeps the call sites self-documenting.

miss-islington-app · 2026-05-13T17:33:48Z

Thanks @gpshead for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

bedevere-app · 2026-05-13T17:34:06Z

GH-149792 is a backport of this pull request to the 3.15 branch.

bedevere-app · 2026-05-13T17:34:11Z

GH-149793 is a backport of this pull request to the 3.14 branch.

bedevere-app · 2026-05-13T17:34:17Z

GH-149794 is a backport of this pull request to the 3.13 branch.

bedevere-app · 2026-05-13T17:34:23Z

GH-149795 is a backport of this pull request to the 3.12 branch.

bedevere-app · 2026-05-13T17:34:27Z

GH-149796 is a backport of this pull request to the 3.11 branch.

bedevere-app · 2026-05-13T17:34:37Z

GH-149797 is a backport of this pull request to the 3.10 branch.

…49648) (#149794) gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648) ftpcp() called parse227() directly and passed the source server's self-reported PASV IPv4 address to the target server's PORT command, bypassing the CVE-2021-4189 fix that was applied only to FTP.makepasv(). A malicious source FTP server could use this to redirect the target server's data connection to an arbitrary host:port (SSRF). ftpcp() now uses the source server's actual peer address, honoring the existing trust_server_pasv_ipv4_address opt-out, the same as makepasv(). Thanks to Qi Ding at Aurascape AI for the report. (GHSA-w8c5-q2xf-gf7c) (cherry picked from commit eac4fe3) Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>

…49648) (#149793) gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648) ftpcp() called parse227() directly and passed the source server's self-reported PASV IPv4 address to the target server's PORT command, bypassing the CVE-2021-4189 fix that was applied only to FTP.makepasv(). A malicious source FTP server could use this to redirect the target server's data connection to an arbitrary host:port (SSRF). ftpcp() now uses the source server's actual peer address, honoring the existing trust_server_pasv_ipv4_address opt-out, the same as makepasv(). Thanks to Qi Ding at Aurascape AI for the report. (GHSA-w8c5-q2xf-gf7c) (cherry picked from commit eac4fe3) Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>

…49648) (#149792) gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648) ftpcp() called parse227() directly and passed the source server's self-reported PASV IPv4 address to the target server's PORT command, bypassing the CVE-2021-4189 fix that was applied only to FTP.makepasv(). A malicious source FTP server could use this to redirect the target server's data connection to an arbitrary host:port (SSRF). ftpcp() now uses the source server's actual peer address, honoring the existing trust_server_pasv_ipv4_address opt-out, the same as makepasv(). Thanks to Qi Ding at Aurascape AI for the report. (GHSA-w8c5-q2xf-gf7c) (cherry picked from commit eac4fe3) Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>

…49648) (#149795) gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648) ftpcp() called parse227() directly and passed the source server's self-reported PASV IPv4 address to the target server's PORT command, bypassing the CVE-2021-4189 fix that was applied only to FTP.makepasv(). A malicious source FTP server could use this to redirect the target server's data connection to an arbitrary host:port (SSRF). ftpcp() now uses the source server's actual peer address, honoring the existing trust_server_pasv_ipv4_address opt-out, the same as makepasv(). Thanks to Qi Ding at Aurascape AI for the report. (GHSA-w8c5-q2xf-gf7c) (cherry picked from commit eac4fe3) Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>

…49648) (#149796) gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648) ftpcp() called parse227() directly and passed the source server's self-reported PASV IPv4 address to the target server's PORT command, bypassing the CVE-2021-4189 fix that was applied only to FTP.makepasv(). A malicious source FTP server could use this to redirect the target server's data connection to an arbitrary host:port (SSRF). ftpcp() now uses the source server's actual peer address, honoring the existing trust_server_pasv_ipv4_address opt-out, the same as makepasv(). Thanks to Qi Ding at Aurascape AI for the report. (GHSA-w8c5-q2xf-gf7c) (cherry picked from commit eac4fe3) Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>

…49648) (#149797) gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648) ftpcp() called parse227() directly and passed the source server's self-reported PASV IPv4 address to the target server's PORT command, bypassing the CVE-2021-4189 fix that was applied only to FTP.makepasv(). A malicious source FTP server could use this to redirect the target server's data connection to an arbitrary host:port (SSRF). ftpcp() now uses the source server's actual peer address, honoring the existing trust_server_pasv_ipv4_address opt-out, the same as makepasv(). Thanks to Qi Ding at Aurascape AI for the report. (GHSA-w8c5-q2xf-gf7c) (cherry picked from commit eac4fe3) Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>

gpshead requested a review from giampaolo as a code owner May 10, 2026 18:21

bedevere-appBot mentioned this pull request May 10, 2026
ftplib should not use the host from the PASV response #87451
Closed

bedevere-appBot added the awaiting core review label May 10, 2026

gpshead self-assigned this May 10, 2026

gpshead requested a review from picnixz May 10, 2026 20:15

Merge branch 'main' intopythongh-87451-ftplib-ftpcp
553e9d7

picnixz reviewed May 10, 2026
View reviewed changes

Comment threadLib/test/test_ftplib.py Outdated

picnixz approved these changes May 10, 2026
View reviewed changes

bedevere-appBot added the awaiting merge label May 10, 2026

gpshead added 2 commits May 13, 2026 09:47

Update the thank you attribution.
19999b8

gpshead enabled auto-merge (squash) May 13, 2026 16:59

gpshead merged commit eac4fe3 into python:mainMay 13, 2026
52 checks passed

bedevere-appBot removed the awaiting merge label May 13, 2026

bedevere-appBot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label May 13, 2026

bedevere-appBot removed the needs backport to 3.14 bugs and security fixes label May 13, 2026

bedevere-appBot removed the needs backport to 3.13 bugs and security fixes label May 13, 2026

bedevere-appBot removed the needs backport to 3.12 only security fixes label May 13, 2026

bedevere-appBot removed the needs backport to 3.11 only security fixes label May 13, 2026

bedevere-appBot removed the needs backport to 3.10 only security fixes label May 13, 2026

Navigation Menu

Uh oh!

Uh oh!

gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() - #149648

gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp()#149648
gpshead merged 4 commits into
python:mainfrom
gpshead:gh-87451-ftplib-ftpcp

gpshead commented May 10, 2026•
edited
Loading

Uh oh!

read-the-docs-communityBot commented May 10, 2026

Uh oh!

Uh oh!

Uh oh!

miss-islington-appBot commented May 13, 2026

Uh oh!

bedevere-appBot commented May 13, 2026

Uh oh!

bedevere-appBot commented May 13, 2026

Uh oh!

bedevere-appBot commented May 13, 2026

Uh oh!

bedevere-appBot commented May 13, 2026

Uh oh!

bedevere-appBot commented May 13, 2026

Uh oh!

bedevere-appBot commented May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

gpshead commented May 10, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

read-the-docs-communityBot commented May 10, 2026

Documentation build overview

Uh oh!

Uh oh!

Uh oh!

miss-islington-appBot commented May 13, 2026

Uh oh!

bedevere-appBot commented May 13, 2026

Uh oh!

bedevere-appBot commented May 13, 2026

Uh oh!

bedevere-appBot commented May 13, 2026

Uh oh!

bedevere-appBot commented May 13, 2026

Uh oh!

bedevere-appBot commented May 13, 2026

Uh oh!

bedevere-appBot commented May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

gpshead commented May 10, 2026•
edited
Loading