CyberSec.Space Logo
CVEブラウザに戻る

CVE-2021-40491

MEDIUM
6.5
CVSS Severity Score
EPSS Score0.1780%
EPSS Percentile11.31th
Published2021年9月3日
Last Modified2024年11月21日

Vulnerability Description

The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.

Affected Platforms (CPE)

📦
Gnu

Inetutils

< 2.2
💻
Debian

Debian Linux

= 10.0

References & Advisories

🔗 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993476
🔗 https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd
🔗 https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html
🔗 https://lists.gnu.org/archive/html/bug-inetutils/2021-06/msg00002.html
🔗 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993476
🔗 https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd
🔗 https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html
🔗 https://lists.gnu.org/archive/html/bug-inetutils/2021-06/msg00002.html

関連する脆弱性情報

CVE-2011-486210.0

Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) ...

CVE-2004-14857.5

Buffer overflow in the TFTP client in InetUtils 1.4.2 allows remote malicious DNS servers to execute arbitrary code via a large DN...

CVE-2021-3467910.0

Thycotic Password Reset Server before 5.3.0 allows credential disclosure.

CVE-2021-021110.0

An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protocol Daemon ...