Critical severity9.8NVD Advisory· Published May 6, 2021· Updated Jun 17, 2026
CVE-2021-29921
CVE-2021-29921
Description
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
92<3.9.5+ 1 more
- (no CPE)range: <3.9.5
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:*range: >=3.8.0,<3.8.12
- Range: <3.9.5
- osv-coords83 versionspkg:bitnami/python-minpkg:bitnami/libpythonpkg:rpm/almalinux/python39-pyyamlpkg:rpm/almalinux/python39-pycparserpkg:rpm/almalinux/python38-Cythonpkg:rpm/almalinux/python38-babelpkg:rpm/almalinux/python38-cryptographypkg:rpm/almalinux/python38-idnapkg:rpm/almalinux/python38-mod_wsgipkg:rpm/almalinux/python38-pluggypkg:rpm/almalinux/python38-plypkg:rpm/almalinux/python38-pytestpkg:rpm/almalinux/python38-pyyamlpkg:rpm/almalinux/python39-Cythonpkg:rpm/almalinux/python39-PyMySQLpkg:rpm/almalinux/python39-attrspkg:rpm/almalinux/python39-cffipkg:rpm/almalinux/python39-chardetpkg:rpm/almalinux/python39-cryptographypkg:rpm/almalinux/python39-idnapkg:rpm/almalinux/python39-iniconfigpkg:rpm/almalinux/python39-mod_wsgipkg:rpm/almalinux/python39-more-itertoolspkg:rpm/almalinux/python39-numpypkg:rpm/almalinux/python39-numpy-docpkg:rpm/almalinux/python39-numpy-f2pypkg:rpm/almalinux/python39-packagingpkg:rpm/almalinux/python39-pluggypkg:rpm/almalinux/python39-plypkg:rpm/almalinux/python39-psycopg2-docpkg:rpm/almalinux/python39-psycopg2-testspkg:rpm/almalinux/python39-pypkg:rpm/almalinux/python39-pyparsingpkg:rpm/almalinux/python39-pysockspkg:rpm/almalinux/python39-pytestpkg:rpm/almalinux/python39-requestspkg:rpm/almalinux/python39-scipypkg:rpm/almalinux/python39-tomlpkg:rpm/almalinux/python39-urllib3pkg:rpm/almalinux/python39-wcwidthpkg:rpm/almalinux/python39-wheelpkg:rpm/almalinux/python39-wheel-wheelpkg:rpm/almalinux/python38-PyMySQLpkg:rpm/almalinux/python38-asn1cryptopkg:rpm/almalinux/python38-atomicwritespkg:rpm/almalinux/python38-attrspkg:rpm/almalinux/python38-cffipkg:rpm/almalinux/python38-chardetpkg:rpm/almalinux/python38-jinja2pkg:rpm/almalinux/python38-markupsafepkg:rpm/almalinux/python38-more-itertoolspkg:rpm/almalinux/python38-numpypkg:rpm/almalinux/python38-numpy-docpkg:rpm/almalinux/python38-numpy-f2pypkg:rpm/almalinux/python38-packagingpkg:rpm/almalinux/python38-psutilpkg:rpm/almalinux/python38-psycopg2pkg:rpm/almalinux/python38-pycparserpkg:rpm/almalinux/python38-pysockspkg:rpm/almalinux/python38-pytzpkg:rpm/almalinux/python38-requestspkg:rpm/almalinux/python38-scipypkg:rpm/almalinux/python38-setuptoolspkg:rpm/almalinux/python38-setuptools-wheelpkg:rpm/almalinux/python38-sixpkg:rpm/almalinux/python38-urllib3pkg:rpm/almalinux/python38-wcwidthpkg:rpm/almalinux/python38-wheelpkg:rpm/almalinux/python38-wheel-wheelpkg:bitnami/pythonpkg:rpm/almalinux/python39-psutilpkg:rpm/almalinux/python39-psycopg2pkg:rpm/almalinux/python39-setuptoolspkg:rpm/almalinux/python39-setuptools-wheelpkg:rpm/almalinux/python39-sixpkg:rpm/almalinux/python38-psycopg2-docpkg:rpm/almalinux/python38-psycopg2-testspkg:rpm/almalinux/python38-pypkg:rpm/almalinux/python38-pyparsingpkg:rpm/suse/python39&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3pkg:rpm/suse/python39-core&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3pkg:rpm/suse/python39-core&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP3pkg:rpm/opensuse/python39&distro=openSUSE%20Tumbleweed
>= 3.8.0, < 3.8.12+ 82 more
- (no CPE)range: >= 3.8.0, < 3.8.12
- (no CPE)range: >= 3.8.0, < 3.8.12
- (no CPE)range: < 5.4.1-1.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 2.20-3.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 0.29.14-4.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 2.7.0-11.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 2.8-3.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 2.8-6.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 4.6.8-3.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 0.13.0-3.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 3.11-10.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 4.6.6-3.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 5.4.1-1.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 0.29.21-5.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 0.10.1-2.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 20.3.0-2.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 1.14.3-2.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 3.0.4-19.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 3.3.1-2.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 2.10-3.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 1.1.1-2.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 4.7.1-4.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 8.5.0-2.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 1.19.4-3.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 1.19.4-3.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 1.19.4-3.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 20.4-4.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 0.13.1-3.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 3.11-10.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 2.8.6-2.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 2.8.6-2.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 1.10.0-1.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 2.4.7-5.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 1.7.1-4.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 6.0.2-2.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 2.25.0-2.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 1.5.4-3.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 0.10.1-5.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 1.25.10-4.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 0.2.5-3.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 1:0.35.1-4.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 1:0.35.1-4.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 0.10.1-1.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 1.2.0-3.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 1.3.0-8.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 19.3.0-3.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 1.13.2-3.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 3.0.4-19.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 2.10.3-5.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 1.1.1-6.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 7.2.0-5.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 1.17.3-6.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 1.17.3-6.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 1.17.3-6.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 19.2-3.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 5.6.4-4.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 2.8.4-4.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 2.19-3.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 1.7.1-4.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 2019.3-3.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 2.22.0-9.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 1.3.1-4.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 41.6.0-5.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 41.6.0-5.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 1.12.0-10.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 1.25.7-5.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 0.1.7-16.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 0.33.6-6.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 0.33.6-6.module_el8.6.0+2778+cd494b30
- (no CPE)range: >= 3.8.0, < 3.8.12
- (no CPE)range: < 5.8.0-4.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 2.8.6-2.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 50.3.2-4.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 50.3.2-4.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 1.15.0-3.module_el8.6.0+2780+a40f65e1
- (no CPE)range: < 2.8.4-4.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 2.8.4-4.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 1.8.0-8.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 2.4.5-3.module_el8.6.0+2778+cd494b30
- (no CPE)range: < 3.9.6-4.3.4
- (no CPE)range: < 3.9.6-4.3.3
- (no CPE)range: < 3.9.6-4.3.3
- (no CPE)range: < 3.9.7-2.1
- cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm:20.3.2:*:*:*:enterprise:*:*:*+ 1 more
- cpe:2.3:a:oracle:graalvm:20.3.2:*:*:*:enterprise:*:*:*
- cpe:2.3:a:oracle:graalvm:21.1.0:*:*:*:enterprise:*:*:*
- cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
16- bugs.python.org/issue36384nvdIssue TrackingPatchVendor Advisory
- github.com/python/cpython/pull/12577nvdPatchThird Party Advisory
- github.com/python/cpython/pull/25099nvdPatchThird Party Advisory
- www.oracle.com//security-alerts/cpujul2021.htmlnvdPatchThird Party Advisory
- www.oracle.com/security-alerts/cpuapr2022.htmlnvdPatchThird Party Advisory
- www.oracle.com/security-alerts/cpujan2022.htmlnvdPatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.htmlnvdPatchThird Party Advisory
- github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.mdnvdExploitThird Party Advisory
- sick.codes/sick-2021-014nvdExploitThird Party Advisory
- docs.python.org/3/library/ipaddress.htmlnvdVendor Advisory
- github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rstnvdThird Party Advisory
- python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.htmlnvdVendor Advisory
- security.netapp.com/advisory/ntap-20210622-0003/nvdThird Party Advisory
- lists.debian.org/debian-lts-announce/2024/12/msg00000.htmlnvd
- security.gentoo.org/glsa/202305-02nvd
- www.oracle.com/security-alerts/cpujul2022.htmlnvd
News mentions
0No linked articles in our index yet.