CVE-2021-29921
CRITICAL 9.8EPSS 6.9%
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 6.88% chance of exploitation in the next 30 days, 94th percentile
- Published
- 2021-05-06
- Updated
- 2026-10-08
Proof-of-concept exploits (2)
- sickcodes/security/blob/master/advisories/SICK-2021-014.md92★ · 2022-07-29
- https://sick.codes/sick-2021-014
Security advisories
- https://bugs.python.org/issue36384
- https://docs.python.org/3/library/ipaddress.html
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
- python/cpython/pull/12577
- sickcodes
- https://security.netapp.com/advisory/ntap-20210622-0003
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujul2022.html