CVE-2021-40491

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993476Third Party Advisory
https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50ddPatch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00033.htmlMailing List, Third Party Advisory
https://lists.gnu.org/archive/html/bug-inetutils/2021-06/msg00002.htmlMailing List, Vendor Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993476Third Party Advisory
https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50ddPatch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00033.htmlMailing List, Third Party Advisory
https://lists.gnu.org/archive/html/bug-inetutils/2021-06/msg00002.htmlMailing List, Vendor Advisory

Timeline

Published: Sep 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-404926.1A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaSc CVE-2021-404939.8Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObjec CVE-2021-404949.8A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system.CVE-2021-404955.3There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751 CVE-2021-404964.3SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attack CVE-2021-404975.3SAP BusinessObjects Analysis (edition for OLAP) - versions 420, 430, allows an attacker to exploit certain application endpoints to read sen CVE-2021-404985.5A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacke CVE-2021-404999.8Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, CVE-2021-40506.1livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-405007.5SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit miss CVE-2021-405018.1SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business us CVE-2021-405028.8SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, result