Medium DLA-3251-1 1 CVE

libcommons-net-java - security update

Published Dec 29, 2022 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 10	libcommons-net-java	3.6-1+deb10u1

Vulnerabilities 1

Medium 6.5

CVE-2021-37533

Apache Commons Net's FTP client trusts the host from PASV response by default

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may l…

Apache Software Foundation Apache Commons Net druid libcommons-net-java Debian Ubuntu Wolfi Maven

Dec 3, 2022