Critical severity · published May 6, 2021
CVE-2021-29921
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string
9.8
CVSS
6.9%
EPSS
No
On KEV
Description
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.9% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Communications Cloud Native Core Automated Test Suite · Oracle
1.8.0 · source: NVD
CC
Communications Cloud Native Core Binding Support Function · Oracle
1.11.0 · source: NVD
CC
Communications Cloud Native Core Network Slice Selection Function · Oracle
1.8.0 · source: NVD
GR
Graalvm · Oracle
20.3.2; 21.1.0 · source: NVD
PY
Python · Python
3.8.0 before 3.8.12; 3.9.0 before 3.9.5 · source: NVD
ZS
Zfs Storage Appliance Kit · Oracle
8.8 · source: NVD
Affected product
CC
Communications Cloud Native Core Automated Test Suite
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-29921
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-29921
Issue Tracking
https://bugs.python.org/issue36384
Vendor Advisory
https://docs.python.org/3/library/ipaddress.html
Third Party Advisory
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
Patch
https://github.com/python/cpython/pull/12577
Patch
https://github.com/python/cpython/pull/25099
Third Party Advisory
https://github.com/sickcodes
More from Communications Cloud Native Core Automated Test Suite
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
9.8
CVE-2022-22963
VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
9.8
CVE-2017-1000353
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution
8.5
CVE-2021-39144
XStream is vulnerable to a Remote Command Execution attack
8.8
CVE-2021-39139
XStream is vulnerable to an Arbitrary Code Execution attack