CVE-2021-37533

Prior to Apache Commons Net 3.9.0, Net’s FTP client trusts the host from
PASV response by default. A malicious server can redirect the Commons Net
code to use a different host, but the user has to connect to the malicious
server in the first place. This may lead to leakage of information about
services running on the private network of the client. The default in
version 3.9.0 is now false to ignore such hosts, as cURL does. See
https://issues.apache.org/jira/browse/NET-711.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1025910&gt;