CVE-2021-29921: oracle communications_cloud_native_core_automated_test_suite
Vulnerability summary
CVE-2021-29921 is a critical (CVSS 9.8) vulnerability in oracle communications_cloud_native_core_automated_test_suite. EPSS estimates a 6.76% chance of exploitation in the next 30 days, higher than 93.9% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 2Timeline
- 06-05-2021PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
6.76%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
Decrease -0.12 pp
From 6.88% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundSecurity
Maturity: poc
Exploit Reference (sick.codes)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Oracle5 products
Mageia3 products
- python-pip< 21.1.3-1.mga8
- python-setuptools< 56.2.0-1.mga8
- python3< 3.8.11-1.1.mga8
Suse3 products
- python39-core&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 3.9.6-4.3.3
- python39-core&distro=SUSE Linux Enterprise Module for Development Tools 15 SP3< 3.9.6-4.3.3
- python39&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 3.9.6-4.3.4
Ubuntu2 products
- python3.8< 3.8.5-1~20.04.3 | < 3.8.10-0ubuntu1~20.04.1 | < 3.8.0-3ubuntu1~18.04.2+esm2
- python3.9< 3.9.5-3~20.04.1
Alpine1 product
- python3< 3.9.5-r0
Debian1 product
- pypy3< 7.3.8+dfsg-1
Python1 product
- python≥ 3.8.0, < 3.8.12 | ≥ 3.9.0, < 3.9.5
7 vendors · 16 products
References
34 links- github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rstREPORTThird Party Advisory
- github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.mdREPORTExploitThird Party Advisory
Show all 34 references
- security.netapp.com/advisory/ntap-20210622-0003/Third Party Advisory
- security.gentoo.org/glsa/202305-02Vendor Advisory
