Apache Commons Net's FTP client trusts the host from PASV response by default
Priority LOW 33CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 2 fixed, 18 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02129 82nd percentileScored 2026-11-07
Fix Partial Apache Commons Net (Apache Software Foundation): 3.9.0commons-net:commons-net (Maven): 3.9.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 18 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Commons Net | Apache Commons Net to before 3.9.0 | 3.9.0 | Patch available | CNA |
| — | commons-net:commons-net (Maven) | before 3.9.0 | 3.9.0 | Patch available | GHSA-cgp8-4m63-fhh5 |
- Apache Commons Net VendorApache Affected Apache Commons Net to before 3.9.0 Fixed in 3.9.0 Patch available CNA
- commons-net:commons-net (Maven) Vendor— Affected before 3.9.0 Fixed in 3.9.0 Patch available GHSA-cgp8-4m63-fhh5
Remediation
- Fix · CNA Apache Commons Net (Apache Software Foundation) Fixed in 3.9.0
- Fix · GHSA-cgp8-4m63-fhh5 commons-net:commons-net (Maven) Fixed in 3.9.0 Advisory →
Red Hat 2 advisories
- RHSA-2023:3667 Released 2023-06-19 · Red Hat rating ModerateRed Hat Integration Camel Extensions for Quarkus 2.13.3 security update
- RHINT Camel-Q 2.13.3
- RHSA-2023:2100 Released 2023-05-03 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 3.20.1 security update
- RHINT Camel-Springboot 3.20.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Migration Toolkit for Runtimes | Affected | No fix planned: Will not fix |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| RHINT Camel-Q 2.13.3 | Fixed | RHSA-2023:3667 |
| RHINT Camel-Springboot 3.20.1 | Fixed | RHSA-2023:2100 |
Not affected: 8 products
- A-MQ Clients 2
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Applications 6
- Migration Toolkit for Runtimes
- Red Hat Decision Manager 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2021-37533
- 2026-10-03 Alias added: GHSA-cgp8-4m63-fhh5
- 2026-11-05 Affected versions changed · Red Hat
References
Advisory 5
- https://lists.apache.org/thread/o6yn9r9x6s94v97264hmgol1sf48mvx7
- [oss-security] 20221203 CVE-2021-37533: Apache Commons Net's FTP client trusts the host from PASV response by default
- [debian-lts-announce] 20221229 [SECURITY] [DLA 3251-1] libcommons-net-java security update
- DSA-5307
- https://nvd.nist.gov/vuln/detail/CVE-2021-37533
Sources
- CVE-2021-37533 · CVE Program
- CVE-2021-37533 · NVD
- FIRST EPSS
- GHSA-cgp8-4m63-fhh5 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-37533 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences