Description
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Commons Net | Apache Commons Net – < 3.9.0 | 3.9.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcommons-net-java | 3.9.0-1 | — |
| Debian 13 | libcommons-net-java | 3.9.0-1 | — |
| Debian 12 | libcommons-net-java | 3.9.0-1 | — |
| Debian 11 | libcommons-net-java | 3.6-1+deb11u1 | DSA-5307-1 |
| Debian 10 | libcommons-net-java | 3.6-1+deb10u1 | DLA-3251-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | libcommons-net-java | 3.6-1+deb11u1build0.22.04.1 | USN-6037-1 |
| Ubuntu 20.04 LTS | libcommons-net-java | 3.6-1+deb11u1build0.20.04.1 | USN-6037-1 |
| Ubuntu 18.04 LTS | libcommons-net-java | 3.6-1+deb11u1build0.18.04.1 | USN-6037-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | libcommons-net-java | 3.4-2ubuntu2+esm1 | USN-6037-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache-commons-net | 3.9.0-1.1 | openSUSE-SU-2024:12549-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | druid | 35.0.1-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | commons-net:commons-net | < 3.9.0 | 3.9.0 | GHSA-cgp8-4m63-fhh5 |
Advisories 37
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2023-1142 Red Hat Integration Camel for Spring Boot: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-6037-1 Apache Commons Net vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- WID-SEC-2024-1637 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 1, 2026
- WID-SEC-2024-0123 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 7, 2026
- DSA-5307-1 libcommons-net-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3251-1 libcommons-net-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:12549-1 apache-commons-net-3.9.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1642 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 20, 2024
- NCSC-2024-0299 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0298 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0296 Kwetsbaarheden verholpen in Oracle Enterprise Manager NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0294 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0293 Kwetsbaarheden verholpen in Oracle Communications Applications NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1643 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2024-1639 Oracle Enterprise Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2024-0870 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 22, 2024
- WID-SEC-2024-0893 Oracle PeopleSoft: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2024-0888 Oracle Systems: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2024-0107 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2023-1016 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-1807 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-2687 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-2681 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-2680 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-2679 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-2675 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-1804 Oracle Insurance Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-1791 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-1783 Oracle Supply Chain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-1813 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-1811 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-1808 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-1032 Oracle PeopleSoft: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2023-0613 IBM MQ: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Mar 9, 2023
- WID-SEC-2023-0121 Oracle Support Tools: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023
- WID-SEC-2022-2264 SOS GmbH JobScheduler: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Dec 7, 2022
References
- https://lists.apache.org/thread/o6yn9r9x6s94v97264hmgol1sf48mvx7
- [oss-security] 20221203 CVE-2021-37533: Apache Commons Net's FTP client trusts the host from PASV response by default mailing-list
- [debian-lts-announce] 20221229 [SECURITY] [DLA 3251-1] libcommons-net-java security update mailing-list
- DSA-5307 vendor-advisory