CVE-2021-40491

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-03 · updated 2026-06-17
Weakness: CWE-345

Description

The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.

Affected products

Debian Linux: 10.0
GNU inetutils: before 2.2 — fixed in 2.2

How to fix

Upgrade to a fixed version: GNU inetutils 2.2. Check the vendor advisory for mitigations.

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993476
https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd
https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html
https://lists.gnu.org/archive/html/bug-inetutils/2021-06/msg00002.html
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993476
https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd
https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html
https://lists.gnu.org/archive/html/bug-inetutils/2021-06/msg00002.html

Get alerted when CVE-2021-40491 or the next vulnerability affects your stack