Skip to content

Commit d0312ce

Browse files
authored
[3.9] bpo-43285: Add a What's New entry for 3.9.3. (GH-24888)
Covers the ftplib security fix.
1 parent 7dcb4ba commit d0312ce

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

‎Doc/whatsnew/3.9.rst‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1529,3 +1529,12 @@ separator key, with ``&`` as the default. This change also affects
15291529
functions internally. For more details, please see their respective
15301530
documentation.
15311531
(Contributed by Adam Goldschmidt, Senthil Kumaran and Ken Jin in :issue:`42967`.)
1532+
1533+
Notable changes in Python 3.9.3
1534+
===============================
1535+
1536+
A security fix alters the :class:`ftplib.FTP` behavior to not trust the
1537+
IPv4 address sent from the remote server when setting up a passive data
1538+
channel. We reuse the ftp server IP address instead. For unusual code
1539+
requiring the old behavior, set a ``trust_server_pasv_ipv4_address``
1540+
attribute on your FTP instance to ``True``. (See :issue:`43285`)

0 commit comments

Comments
 (0)