CVE-2026-8328

Katalog CVE

CVSS 5.9 · Medium EPSS 0,46%

Kerentanan Server-Side Request Forgery (SSRF). Skor CVSS 4.0 5.9 (Medium) menurut python.org.

Deskripsi (NVD)

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.

Rincian

Terbit di NVD

13 Mei 2026

Terakhir diubah

13 Agustus 2026

Status NVD

Awaiting Analysis

CVSS 4.0

5.9 (Medium), sumber python.org
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5f
• https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06
• https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0
• https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763
• https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d
• https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9
• https://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fceb
• https://github.com/python/cpython/issues/87451
• https://github.com/python/cpython/pull/149648
• https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/