CVE-2021-29921
Summary
| CVE | CVE-2021-29921 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-05-06 13:15:00 UTC |
| Updated | 2023-05-03 11:15:00 UTC |
| Description | In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Oracle | Communications Cloud Native Core Automated Test Suite | 1.8.0 | All | All | All |
| Application | Oracle | Communications Cloud Native Core Binding Support Function | 1.11.0 | All | All | All |
| Application | Oracle | Communications Cloud Native Core Network Slice Selection Function | 1.8.0 | All | All | All |
| Application | Oracle | Graalvm | 20.3.2 | All | All | All |
| Application | Oracle | Graalvm | 21.1.0 | All | All | All |
| Application | Oracle | Zfs Storage Appliance Kit | 8.8 | All | All | All |
| Application | Python | Python | All | All | All | All |
| Application | Python | Python | All | All | All | All |
| Application | Python | Python | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| bpo-36384: Leading zeros in IPv4 addresses are no longer tolerated by tiran · Pull Request #25099 · python/cpython · GitHub | MISC | github.com | |
| ipaddress leading zeros in IPv4 address — Python Security 0.0 documentation | MISC | python-security.readthedocs.io | |
| Oracle Critical Patch Update Advisory - April 2022 | MISC | www.oracle.com | |
| cpython/3.8.0a4.rst at 63298930fb531ba2bb4f23bc3b915dbf1e17e9e1 · python/cpython · GitHub | MISC | github.com | |
| Oracle Critical Patch Update Advisory - July 2021 | N/A | www.oracle.com | |
| Issue 36384: [security] CVE-2021-29921: ipaddress Should not reject IPv4 addresses with leading zeroes as ambiguously octal - Python tracker | MISC | bugs.python.org | |
| Oracle Critical Patch Update Advisory - October 2021 | MISC | www.oracle.com | |
| Oracle Critical Patch Update Advisory - January 2022 | MISC | www.oracle.com | |
| security/SICK-2021-014.md at master · sickcodes/security · GitHub | MISC | github.com | |
| Python, PyPy3: Multiple Vulnerabilities (GLSA 202305-02) — Gentoo security | GENTOO | security.gentoo.org | |
| CVE-2021-29921 Python Vulnerability in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| sickcodes (sickcodes) · GitHub | MISC | github.com | |
| CVE-2021-29921 - python stdlib "ipaddress" - Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in indeterminate SSRF & RFI vulnerabilities. - "ipaddress leading zeros in IPv4 address" - Sick Codes - Security Research, Hardware & Software Hacking, Consulting, Linux, IoT, Cloud, Embedded, Arch, Tweaks & Tips! | MISC | sick.codes | |
| bpo-36384: Remove check for leading zeroes in IPv4 addresses by TV4Fun · Pull Request #12577 · python/cpython · GitHub | MISC | github.com | |
| ipaddress — IPv4/IPv6 manipulation library — Python 3.9.4 documentation | MISC | docs.python.org | |
| Oracle Critical Patch Update Advisory - July 2022 | N/A | www.oracle.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159466 Oracle Enterprise Linux Security Update for python39:3.9 and python39-devel:3.9 (ELSA-2021-4160)
- 159467 Oracle Enterprise Linux Security Update for python38:3.8 and python38-devel:3.8 (ELSA-2021-4162)
- 198392 Ubuntu Security Notification for Python vulnerability (USN-4973-1)
- 198529 Ubuntu Security Notification for Python Vulnerability (USN-4973-2)
- 239580 Red Hat Update for rh-python38 (RHSA-2021:3254)
- 239841 Red Hat Update for python39:3.9 and python39-devel:3.9 (RHSA-2021:4160)
- 239845 Red Hat Update for python38:3.8 and python38-devel:3.8 (RHSA-2021:4162)
- 296068 Oracle Solaris 11.4 Support Repository Update (SRU) 34.94.4 Missing (CPUAPR2021)
- 356244 Amazon Linux Security Advisory for python38 : ALASPYTHON3.8-2023-009
- 375538 Python3 RFI/SSRF Vulnerability
- 502021 Alpine Linux Security Update for python3
- 504347 Alpine Linux Security Update for python3
- 672336 EulerOS Security Update for python-pip (EulerOS-SA-2022-2740)
- 672356 EulerOS Security Update for python-pip (EulerOS-SA-2022-2775)
- 672442 EulerOS Security Update for python-pip (EulerOS-SA-2022-2854)
- 672444 EulerOS Security Update for python-pip (EulerOS-SA-2022-2828)
- 710714 Gentoo Linux Python, PyPy3 Multiple Vulnerabilities (GLSA 202305-02)
- 751095 OpenSUSE Security Update for python39 (openSUSE-SU-2021:2940-1)
- 940526 AlmaLinux Security Update for python38:3.8 and python38-devel:3.8 (ALSA-2021:4162)
- 940559 AlmaLinux Security Update for python39:3.9 and python39-devel:3.9 (ALSA-2021:4160)
- 960239 Rocky Linux Security Update for python39:3.9 and python39-devel:3.9 (RLSA-2021:4160)
- 960342 Rocky Linux Security Update for python38:3.8 and python38-devel:3.8 (RLSA-2021:4162)