This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-29921 →

DEBIAN-CVE-2021-29921

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allo...

Original description

The description as published by the source.

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 pypy3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.8+dfsg-1"}]}]

Debian:13 pypy3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.8+dfsg-1"}]}]

Debian:14 pypy3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.8+dfsg-1"}]}]

References

advisory security-tracker.debian.org