CVE-2021-29921: Input Validation
First published: Fri Apr 30 2021(Updated: )
A flaw was found in python-ipaddress. Improper input validation of octal strings in stdlib ipaddress allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many programs that rely on Python stdlib ipaddress. The highest threat from this vulnerability is to data integrity and system availability.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/rh-python38-babel | <0:2.7.0-12.el7 | 0:2.7.0-12.el7 |
| redhat/rh-python38-python | <0:3.8.11-2.el7 | 0:3.8.11-2.el7 |
| redhat/rh-python38-python-cryptography | <0:2.8-5.el7 | 0:2.8-5.el7 |
| redhat/rh-python38-python-jinja2 | <0:2.10.3-6.el7 | 0:2.10.3-6.el7 |
| redhat/rh-python38-python-lxml | <0:4.4.1-7.el7 | 0:4.4.1-7.el7 |
| redhat/rh-python38-python-pip | <0:19.3.1-2.el7 | 0:19.3.1-2.el7 |
| redhat/rh-python38-python-urllib3 | <0:1.25.7-7.el7 | 0:1.25.7-7.el7 |
| redhat/python | <3.9 | 3.9 |
| Python Python | >=3.8.0<3.8.12 | |
| Python Python | >=3.9.0<3.9.5 | |
| Oracle Communications Cloud Native Core Automated Test Suite | =1.8.0 | |
| Oracle Communications Cloud Native Core Binding Support Function | =1.11.0 | |
| Oracle Communications Cloud Native Core Network Slice Selection Function | =1.8.0 | |
| Oracle GraalVM | =20.3.2 | |
| Oracle GraalVM | =21.1.0 | |
| Oracle ZFS Storage Appliance Kit | =8.8 | |
| debian/pypy3 | 7.3.5+dfsg-2+deb11u2 7.3.5+dfsg-2+deb11u3 7.3.11+dfsg-2+deb12u2 7.3.17+dfsg-2 | |
| debian/python2.7 | 2.7.18-8+deb11u1 | |
| debian/python3.9 | <=3.9.2-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2021-29921 https://nvd.nist.gov/vuln/detail/CVE-2021-29921 https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1957458
- https://access.redhat.com/errata/RHSA-2021:4160
- https://access.redhat.com/errata/RHSA-2021:4162
- https://access.redhat.com/errata/RHSA-2021:3254
- https://access.redhat.com/security/cve/CVE-2021-29921
- https://bugs.python.org/issue36384#msg392423
- https://tools.ietf.org/html/rfc3986#section-7.4
- https://docs.python.org/3/library/ipaddress.html#ipaddress.IPv4Address
- https://github.com/python/cpython/commit/60ce8f0be6354ad565393ab449d8de5d713f35bc
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1957458#c4
- https://access.redhat.com/security/cve/cve-2021-29921
- https://bugs.python.org/issue36384
- https://docs.python.org/3/library/ipaddress.html
- https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
- https://github.com/python/cpython/pull/12577
- https://github.com/python/cpython/pull/25099
- https://github.com/sickcodes
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20210622-0003/
- https://sick.codes/sick-2021-014
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://launchpad.net/bugs/cve/CVE-2021-29921
- https://github.com/python/cpython/commit/5374fbc31446364bf5f12e5ab88c5493c35eaf04
- https://github.com/python/cpython/commit/e653d4d8e820a7a004ad399530af0135b45db27a
- https://security-tracker.debian.org/tracker/CVE-2021-29921
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
- https://nvd.nist.gov/vuln/detail/CVE-2021-29921
- https://ubuntu.com/security/CVE-2021-29921
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-29921.
What is the severity of CVE-2021-29921?
The severity of CVE-2021-29921 is critical.
How does CVE-2021-29921 affect Python before version 3.9.5?
CVE-2021-29921 allows unauthenticated remote attackers to perform SSRF, RFI, and LFI attacks on programs that rely on Python stdlib ipaddress.
How can I fix CVE-2021-29921?
To fix CVE-2021-29921, update to Python version 3.9.5 or later.
Where can I find more information about CVE-2021-29921?
You can find more information about CVE-2021-29921 at the following references: [CVE-2021-29921](https://www.cve.org/CVERecord?id=CVE-2021-29921), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-29921), [Python Security](https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1957458), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2021:4160).
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-29921
- agent/software-canonical-lookup
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/remedy
- agent/description
- collector/nvd-cve
- source/NVD
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- package-manager/redhat
- vendor/python
- canonical/python python
- version/python python/3.8.0
- version/python python/3.9.0
- vendor/oracle
- canonical/oracle communications cloud native core automated test suite
- version/oracle communications cloud native core automated test suite/1.8.0
- canonical/oracle communications cloud native core binding support function
- version/oracle communications cloud native core binding support function/1.11.0
- canonical/oracle communications cloud native core network slice selection function
- version/oracle communications cloud native core network slice selection function/1.8.0
- canonical/oracle graalvm
- version/oracle graalvm/20.3.2
- version/oracle graalvm/21.1.0
- canonical/oracle zfs storage appliance kit
- version/oracle zfs storage appliance kit/8.8
- package-manager/debian