Debian Security Bug TrackerDEBIANCVE:CVE-2021-37533CVE-2021-37533
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
0.003 Low
EPSS
Percentile
65.5%
Prior to Apache Commons Net 3.9.0, Net’s FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | libcommons-net-java | < 3.9.0-1 | libcommons-net-java_3.9.0-1_all.deb |
| Debian | 11 | all | libcommons-net-java | < 3.6-1+deb11u1 | libcommons-net-java_3.6-1+deb11u1_all.deb |
| Debian | 999 | all | libcommons-net-java | < 3.9.0-1 | libcommons-net-java_3.9.0-1_all.deb |
| Debian | 13 | all | libcommons-net-java | < 3.9.0-1 | libcommons-net-java_3.9.0-1_all.deb |
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
0.003 Low
EPSS
Percentile
65.5%