The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
3.10.12-1~22.04.163.12.3-1ubuntu0.153.13.3-13.13.3-23.13.3-43.13.4-13.13.5-13.13.5-23.13.6-13.13.7-13.13.7-1ubuntu0.13.13.7-1ubuntu0.2+2 more3.14.0-13.14.0-1ubuntu0.13.14.0-1ubuntu0.23.14.0-1ubuntu0.33.14.0~a7-0ubuntu13.14.0~b1-13.14.0~b3-13.14.0~rc1-13.14.0~rc2-13.14.0~rc3-13.14.4-1ubuntu0.1Exploitability
AV:NAC:LAT:PPR:NUI:AVulnerable System
VC:NVI:HVA:NSubsequent System
SC:NSI:NSA:NCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N