CVE-2021-29921

NameCVE-2021-29921
DescriptionIn Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs989195

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
pypy (PTS)jessie2.4.0+dfsg-3fixed
stretch5.6.0+dfsg-4fixed
buster7.0.0+dfsg-3fixed
bullseye7.3.3+dfsg-2fixed
pypy3 (PTS)buster7.0.0+dfsg-3vulnerable
bullseye (security), bullseye7.3.5+dfsg-2+deb11u2fixed
bookworm7.3.11+dfsg-2+deb12u2fixed
sid, trixie7.3.17+dfsg-2fixed
python2.7 (PTS)jessie, jessie (lts)2.7.9-2-ds1-1+deb8u12fixed
stretch (security)2.7.13-2+deb9u6fixed
stretch (lts), stretch2.7.13-2+deb9u9fixed
buster (security), buster, buster (lts)2.7.16-2+deb10u4fixed
bullseye2.7.18-8+deb11u1fixed
python3.9 (PTS)bullseye3.9.2-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
pypysource(unstable)(not affected)
pypy3sourcebullseye(not affected)
pypy3source(unstable)7.3.8+dfsg-1
python2.7source(unstable)(not affected)
python3.9sourceexperimental3.9.5-1
python3.9source(unstable)3.9.7-1989195

Notes

[bullseye] - python3.9 <no-dsa> (Minor issue)
- python2.7 <not-affected> (Vulnerable code introduced later)
[buster] - pypy3 <no-dsa> (Minor issue)
[bullseye] - pypy3 <not-affected> (Vulnerable code introduced later)
https://bugs.python.org/issue36384#msg392423
https://github.com/python/cpython/commit/60ce8f0be6354ad565393ab449d8de5d713f35bc (v3.10.0b1)
https://github.com/python/cpython/commit/5374fbc31446364bf5f12e5ab88c5493c35eaf04 (v3.9.5)
Introduced by: https://github.com/python/cpython/commit/e653d4d8e820a7a004ad399530af0135b45db27a (v3.8.0a4)
- pypy <not-affected> (Vulnerable code introduced later)

Search for package or bug name: Reporting problems