CVEvulnerability
CVE-2021-29921
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-05-06
- Last modified
- 2026-10-08
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
Affected configurations
• python python (>= 3.8.0 < 3.8.12)
• python python (>= 3.9.0 < 3.9.5)
• oracle communications cloud native core automated test suite 1.8.0
• oracle communications cloud native core binding support function 1.11.0
• oracle communications cloud native core network slice selection function 1.8.0
• oracle graalvm 20.3.2
• oracle graalvm 21.1.0
• oracle zfs storage appliance kit 8.8
Related
Referenced by CWE · observed example (1)
- CWE-1389 Incorrect Parsing of Numbers with Different Radices weakness
References
- https://bugs.python.org/issue36384 Issue Tracking, Patch, Vendor Advisory
- https://docs.python.org/3/library/ipaddress.html Vendor Advisory
- https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst Third Party Advisory
- https://github.com/python/cpython/pull/12577 Patch, Third Party Advisory
- https://github.com/python/cpython/pull/25099 Patch, Third Party Advisory
- https://github.com/sickcodes Third Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md Exploit, Third Party Advisory
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html Vendor Advisory
- https://security.gentoo.org/glsa/202305-02 security.gentoo.org
- https://security.netapp.com/advisory/ntap-20210622-0003/ Third Party Advisory
- https://sick.codes/sick-2021-014 Exploit, Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html www.oracle.com
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory
- https://bugs.python.org/issue36384 Issue Tracking, Patch, Vendor Advisory
- https://docs.python.org/3/library/ipaddress.html Vendor Advisory
- https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst Third Party Advisory
- https://github.com/python/cpython/pull/12577 Patch, Third Party Advisory
- https://github.com/python/cpython/pull/25099 Patch, Third Party Advisory
- https://github.com/sickcodes Third Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html lists.debian.org
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html Vendor Advisory
- https://security.gentoo.org/glsa/202305-02 security.gentoo.org
- https://security.netapp.com/advisory/ntap-20210622-0003/ Third Party Advisory
- https://sick.codes/sick-2021-014 Exploit, Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html www.oracle.com
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory