CVE-2021-40491

Katalog CVE

CVSS 6.5 · Medium EPSS 1,0%

Kerentanan Insufficient Verification of Data Authenticity pada gnu inetutils, debian linux. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.

Rincian

Terbit di NVD

3 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd patch · advisory vendor
• https://lists.gnu.org/archive/html/bug-inetutils/2021-06/msg00002.html mailing list · advisory vendor
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993476 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html mailing list · advisory pihak ketiga