CVE-2021-29921
- Source
- https://cve.org/CVERecord?id=CVE-2021-29921
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-29921.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-29921
- Aliases
- Downstream
- Related
- Published
- 2021-05-06T13:15:12.573Z
- Modified
- 2026-04-02T06:51:10.852555Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
- References
-
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
- https://github.com/sickcodes
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
- https://docs.python.org/3/library/ipaddress.html
- https://security.netapp.com/advisory/ntap-20210622-0003/
- https://security.gentoo.org/glsa/202305-02
- https://bugs.python.org/issue36384
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/python/cpython/pull/12577
- https://github.com/python/cpython/pull/25099
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://sick.codes/sick-2021-014
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
Affected packages
Git / github.com/graalvm/graalvm-ce-builds
Affected ranges
- Type
- GIT
- Repo
- https://github.com/graalvm/graalvm-ce-builds
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affected
- Database specific
{ "versions": [ { "introduced": "0" }, { "last_affected": "20.3.2" }, { "introduced": "0" }, { "last_affected": "21.1.0" } ] }
Affected versions
v3.*
v3.8.0
v3.8.1
v3.8.10
v3.8.11
v3.8.1rc1
v3.8.2
v3.8.2rc1
v3.8.2rc2
v3.8.3
v3.8.3rc1
v3.8.4
v3.8.4rc1
v3.8.5
v3.8.6
v3.8.6rc1
v3.8.7
v3.8.7rc1
v3.8.8
v3.8.8rc1
v3.8.9
v3.9.0
v3.9.1
v3.9.1rc1
v3.9.2
v3.9.2rc1
v3.9.3
v3.9.4
vm-19.*
vm-19.3.0
vm-19.3.0.2
vm-19.3.1
vm-19.3.2
vm-19.3.2-pre
vm-19.3.3
vm-19.3.4
vm-19.3.5
vm-19.3.6
vm-20.*
vm-20.0.0
vm-20.0.1
vm-20.1.0
vm-20.2.0
vm-20.3.0
vm-20.3.1
vm-20.3.1.2
vm-20.3.2
vm-21.*
vm-21.0.0
vm-21.0.0.2
vm-ce-21.*
vm-ce-21.2.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-29921.json"
unresolved_ranges
[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.8.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.11.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.8.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8"
}
]
}
]