[NET-711] Add FTP option to toggle use of return host like cURL

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.9.0
• Component/s: FTP
• Assignee: Unassigned
• Reporter: Gary D. Gregory
• Created: 28/Mar/22 17:00
• Updated: 15/Dec/22 17:30
• Resolved: 07/Nov/22 15:08

Description

Apache Commons Net's FTP client trusts the host from PASV response by default.

The default in version 3.9.0 is now false to ignore such hosts, as cURL does.

To restore the pre-3.9.0 behavior, either:

• Set the new system property to org.apache.commons.net.ftp.ipAddressFromPasvResponse to true.
• Call FTPClient#setIpAddressFromPasvResponse(true);

Issue Links

• is related to: HADOOP-18561 CVE-2021-37533 on commons-net is included in hadoop common and hadoop-client-runtime