CVE-2021-29921

high-risk
Published 2021-05-06

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.

Do I need to act?

~
2.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (7)

Affected Vendors

Oracle Python

References (33)

Issue Tracking https://bugs.python.org/issue36384
Vendor Advisory https://docs.python.org/3/library/ipaddress.html
Third Party Advisory https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/...
Patch https://github.com/python/cpython/pull/12577
Patch https://github.com/python/cpython/pull/25099
Third Party Advisory https://github.com/sickcodes
Exploit https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
Vendor Advisory https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.gentoo.org/glsa/202305-02
Third Party Advisory https://security.netapp.com/advisory/ntap-20210622-0003/
Exploit https://sick.codes/sick-2021-014
Patch https://www.oracle.com//security-alerts/cpujul2021.html
Patch https://www.oracle.com/security-alerts/cpuapr2022.html
Patch https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
Patch https://www.oracle.com/security-alerts/cpuoct2021.html
Issue Tracking https://bugs.python.org/issue36384
Vendor Advisory https://docs.python.org/3/library/ipaddress.html
Third Party Advisory https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/...
Patch https://github.com/python/cpython/pull/12577
and 13 more references
51
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 5/34 · Minimal
Exposure 14/34 · Moderate