CVE-2021-29921

Description

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.

How to fix CVE-2021-29921

To remediate CVE-2021-29921, upgrade the affected package to a fixed version below.

• Alpine/python3—upgrade to 3.9.5-r0 or later
• Bitnami/libpython—upgrade to 3.8.12 or later
• —upgrade to 3.8.12 or later
• —upgrade to 3.8.12 or later
• —upgrade to 7.3.8+dfsg-1 or later
• —upgrade to 3.9.2-1+deb11u2 or later

Is CVE-2021-29921 being exploited?

Low — EPSS is 2.0%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

• from 0, < 3.9.5-r0
• >= 3.8.0, < 3.8.12, >= 3.9.0, < 3.9.5
• >= 3.8.0, < 3.8.12, >= 3.9.0, < 3.9.5
• >= 3.8.0, < 3.8.12, >= 3.9.0, < 3.9.5
• from 0, < 7.3.8+dfsg-1
• from 0, < 3.9.2-1+deb11u2

CVSS scores

References (20)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2021-29921
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-29921
• WEBbugs.python.org/issue36384
• WEBdocs.python.org/3/library/ipaddress.html