返回 CVE 瀏覽器

CVE-2021-40491

MEDIUM

6.5

CVSS Severity Score

EPSS Score0.1780%

EPSS Percentile11.31th

Published2021年9月3日

Last Modified2024年11月21日

Vulnerability Description

The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.

Affected Platforms (CPE)

📦

Gnu

Inetutils

< 2.2

💻

Debian

Debian Linux

= 10.0

References & Advisories

🔗 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993476

🔗 https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd

🔗 https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html

🔗 https://lists.gnu.org/archive/html/bug-inetutils/2021-06/msg00002.html

🔗 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993476

🔗 https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd

🔗 https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html

🔗 https://lists.gnu.org/archive/html/bug-inetutils/2021-06/msg00002.html

相關漏洞威脅

CVE-2011-486210.0

Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) ...

CVE-2004-14857.5

Buffer overflow in the TFTP client in InetUtils 1.4.2 allows remote malicious DNS servers to execute arbitrary code via a large DN...

CVE-2021-4422810.0

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration...

CVE-2021-021110.0

An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protocol Daemon ...