Insufficient Verification of Data Authenticity Affecting inetutils package, versions *
Snyk CVSS
Attack Complexity
Low
User Interaction
Required
Confidentiality
High
Threat Intelligence
EPSS
0.27% (68th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN9-INETUTILS-1582366
- published 3 Sep 2021
- disclosed 3 Sep 2021
Introduced: 3 Sep 2021
CVE-2021-40491 Open this link in a new tabHow to fix?
There is no fixed version for Debian:9
inetutils
.
NVD Description
Note: Versions mentioned in the description apply only to the upstream inetutils
package and not the inetutils
package as distributed by Debian
.
See How to fix?
for Debian:9
relevant fixed versions and status.
The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.
References
- https://security-tracker.debian.org/tracker/CVE-2021-40491
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993476
- https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd
- https://lists.gnu.org/archive/html/bug-inetutils/2021-06/msg00002.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html