CVE search · CVE-2021-29921
CVE-2021-29921
critical 9.8
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- NVD-CWE-Other
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | critical 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
nvd@nist.govPrimary |
| CVSS 2.0 | high 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- python · python
- oracle · communications_cloud_native_core_automated_test_suite
- oracle · communications_cloud_native_core_binding_support_function
- oracle · communications_cloud_native_core_network_slice_selection_function
- oracle · graalvm
- oracle · zfs_storage_appliance_kit
References
- https://bugs.python.org/issue36384Issue TrackingPatchVendor Advisory
- https://docs.python.org/3/library/ipaddress.htmlVendor Advisory
- https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rstThird Party Advisory
- https://github.com/python/cpython/pull/12577PatchThird Party Advisory
- https://github.com/python/cpython/pull/25099PatchThird Party Advisory
- https://github.com/sickcodesThird Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.mdExploitThird Party Advisory
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.htmlVendor Advisory
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20210622-0003/Third Party Advisory
- https://sick.codes/sick-2021-014ExploitThird Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatchThird Party Advisory
- https://bugs.python.org/issue36384Issue TrackingPatchVendor Advisory
- https://docs.python.org/3/library/ipaddress.htmlVendor Advisory
- https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rstThird Party Advisory
- https://github.com/python/cpython/pull/12577PatchThird Party Advisory
- https://github.com/python/cpython/pull/25099PatchThird Party Advisory
- https://github.com/sickcodesThird Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.mdExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.htmlVendor Advisory
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20210622-0003/Third Party Advisory
- https://sick.codes/sick-2021-014ExploitThird Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatchThird Party Advisory