CVE-2021-29921

תיאור (מקור, אנגלית)

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.

מדדים

CVSS 3.1

9.8 (CRITICAL) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — סבירות ניצול

7% (אחוזון 100) נכון ל-14/10/2026

מוצרים מושפעים

python: python; oracle: communications cloud native core automated test suite; oracle: communications cloud native core binding support function; oracle: communications cloud native core network slice selection function; oracle: graalvm; oracle: zfs storage appliance kit

קישורים

• https://bugs.python.org/issue36384 Issue TrackingPatchVendor Advisory
• https://docs.python.org/3/library/ipaddress.html Vendor Advisory
• https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html Vendor Advisory
• https://bugs.python.org/issue36384 Issue TrackingPatchVendor Advisory
• https://docs.python.org/3/library/ipaddress.html Vendor Advisory
• https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html Vendor Advisory
• https://github.com/python/cpython/pull/12577 PatchThird Party Advisory
• https://github.com/python/cpython/pull/25099 PatchThird Party Advisory
• https://www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory