CVE-2021-36159: 
Linux Alpine vulnerability analysis and mitigation

libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, contains a vulnerability in its handling of numeric strings for FTP and HTTP protocols. The vulnerability was discovered in the FTP passive mode implementation where the software mishandles numeric string parsing (MITRE CVE).

The vulnerability stems from an out-of-bounds read condition in the FTP passive mode implementation. The issue occurs because strtol is used to parse numbers into address bytes without properly checking if the line ends prematurely. The for-loop condition checks for the '\0' terminator one byte too late due to premature p++ operation (Alpine Issue).

The vulnerability allows a malicious FTP server to control the connection buffer size, which can be increased until a newline is encountered. This could potentially lead to information leaks as the buffer can be moved into more interesting areas within the address space, with parsed numbers becoming available to the server in the form of new TCP connection port numbers or IPv6 addresses (Alpine Issue).

The vulnerability can be exploited by a malicious FTP server by manipulating the passive mode responses. The attacker can control the connection buffer size and potentially access memory outside the intended boundaries (Alpine Issue).

The issue was fixed in libfetch after 2021-07-26. The fix includes proper boundary checks for numeric string parsing and validation of buffer limits (FreeBSD Commit).