CVE-2021-29921

NameCVE-2021-29921
DescriptionIn Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs989195

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
pypy3 (PTS)bullseye (security), bullseye7.3.5+dfsg-2+deb11u2fixed
bookworm7.3.11+dfsg-2+deb12u2fixed
sid, trixie7.3.17+dfsg-2fixed
python2.7 (PTS)bullseye2.7.18-8+deb11u1fixed
python3.9 (PTS)bullseye3.9.2-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
pypy3sourcebullseye(not affected)
pypy3source(unstable)7.3.8+dfsg-1
python2.7source(unstable)(not affected)
python3.9sourceexperimental3.9.5-1
python3.9source(unstable)3.9.7-1989195

Notes

[bullseye] - python3.9 <no-dsa> (Minor issue)
- python2.7 <not-affected> (Vulnerable code introduced later)
[buster] - pypy3 <no-dsa> (Minor issue)
[bullseye] - pypy3 <not-affected> (Vulnerable code introduced later)
https://bugs.python.org/issue36384#msg392423
https://github.com/python/cpython/commit/60ce8f0be6354ad565393ab449d8de5d713f35bc (v3.10.0b1)
https://github.com/python/cpython/commit/5374fbc31446364bf5f12e5ab88c5493c35eaf04 (v3.9.5)
Introduced by: https://github.com/python/cpython/commit/e653d4d8e820a7a004ad399530af0135b45db27a (v3.8.0a4)

Search for package or bug name: Reporting problems