תיאור (מקור, אנגלית)
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
מוצרים מושפעים
python: python; oracle: communications cloud native core automated test suite; oracle: communications cloud native core binding support function; oracle: communications cloud native core network slice selection function; oracle: graalvm; oracle: zfs storage appliance kit
קישורים10
- bugs.python.org/issue36384 Issue TrackingPatchVendor Advisory
- docs.python.org/3/library/ipaddress.html Vendor Advisory
- python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zer… Vendor Advisory
- bugs.python.org/issue36384 Issue TrackingPatchVendor Advisory
- docs.python.org/3/library/ipaddress.html Vendor Advisory
- python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zer… Vendor Advisory
- github.com/python/cpython/pull/12577 PatchThird Party Advisory
- github.com/python/cpython/pull/25099 PatchThird Party Advisory
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
מדדים
- CVSS 3.1
-
9.8
CRITICAL
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 7% אחוזון 94 · נכון ל-6 בנובמבר 2026
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.