CVE-2021-29921

Katalog CVE

CVSS 9.8 · Critical EPSS 6,9%

Kerentanan pada python, oracle communications cloud native core automated test suite +4 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.

Rincian

Terbit di NVD

6 Mei 2021

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

6,9% peluang dieksploitasi; lebih tinggi dari 93,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.python.org/issue36384 issue tracking · patch · advisory vendor
• https://docs.python.org/3/library/ipaddress.html advisory vendor
• https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html advisory vendor
• https://github.com/python/cpython/pull/12577 patch · advisory pihak ketiga
• https://github.com/python/cpython/pull/25099 patch · advisory pihak ketiga
• https://www.oracle.com//security-alerts/cpujul2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html patch · advisory pihak ketiga
• https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst advisory pihak ketiga
• https://github.com/sickcodes advisory pihak ketiga
• https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md exploit · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210622-0003/ advisory pihak ketiga
• https://sick.codes/sick-2021-014 exploit · advisory pihak ketiga
• https://security.gentoo.org/glsa/202305-02
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html