|Related CVEs||CVE-2019-16935 CVE-2021-3177 CVE-2021-4189|
Multiple vulnerabilities were found in src:python2.7, the Python interpreter.
Python has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input.
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library when using it in PASV (passive) mode. The flaw lies in how the FTP client trusts the host from PASV response by default. An attacker could use this flaw to setup a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This could lead to FTP client scanning ports which otherwise would not have been possible. . Instead of using the returned address, ftplib now uses the IP address we're already connected to. For the rare user who wants an old behavior, set a `trust_server_pasv_ipv4_address` attribute on your `ftplib.FTP` instance to True.
For Debian 8 jessie, these problems have been fixed in version 2.7.9-2-ds1-1+deb8u9.
We recommend that you upgrade your python2.7 packages.
Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/