CVE-2021-29921
- Source
- https://cve.org/CVERecord?id=CVE-2021-29921
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-29921.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2021-29921
- Aliases
- Downstream
ALPINE (1)
BELL (1)
CLEANSTART (6)
DEBIAN (1)
MGASA (1)
openSUSE (1)
RLSA (2)
- Related
- Published
- 2021-05-06T13:15:12Z
- Modified
- 2026-10-15T02:47:45Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.8.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "1.8.0" }, { "last_affected": "1.8.0" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:communications_cloud_native_core_automated_test_suite" }, { "cpes": [ "cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "1.11.0" }, { "last_affected": "1.11.0" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:communications_cloud_native_core_binding_support_function" }, { "cpes": [ "cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "1.8.0" }, { "last_affected": "1.8.0" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:communications_cloud_native_core_network_slice_selection_function" }, { "cpes": [ "cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "8.8" }, { "last_affected": "8.8" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:zfs_storage_appliance_kit" } ] }- References
-
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://docs.python.org/3/library/ipaddress.html
- https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
- https://github.com/sickcodes
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20210622-0003/
- https://bugs.python.org/issue36384
- https://github.com/python/cpython/pull/12577
- https://github.com/python/cpython/pull/25099
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
- https://sick.codes/sick-2021-014
Affected packages
Git / github.com/graalvm/graalvm-ce-builds
Affected ranges
- Type
- GIT
- Repo
- https://github.com/graalvm/graalvm-ce-builds
- Events
-
IntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:oracle:graalvm:20.3.2:*:*:*:enterprise:*:*:*", "range": [ { "introduced": "20.3.2" }, { "last_affected": "20.3.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:oracle:graalvm:21.1.0:*:*:*:enterprise:*:*:*", "range": [ { "introduced": "21.1.0" }, { "last_affected": "21.1.0" } ], "source": "CPE_STRING" } ] }
Git / github.com/python/cpython
Affected ranges
- Type
- GIT
- Repo
- https://github.com/python/cpython
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.8.0" }, { "fixed": "3.8.12" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.9.0" }, { "fixed": "3.9.5" } ], "source": "CPE_RANGE" } ] }