CVE-2021-29922: rust-lang rust
Vulnerability summary
CVE-2021-29922 is a critical (CVSS 9.1) vulnerability in rust-lang rust. EPSS estimates a 2.62% chance of exploitation in the next 30 days, higher than 85.2% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 07-08-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS trend
Probability
2.62%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.62% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundRust
Maturity: poc
Security
Maturity: poc
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Redhat21 products
- cargo< 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
- cargo-debuginfo< 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
- cargo-doc< 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
- clippy< 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
- clippy-debuginfo< 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
Alpine1 product
- rust< 1.52.1-r1
Debian1 product
- rustc< 1.53.0+dfsg1-1
Rust-lang1 product
- rust< 1.53.0
Ubuntu1 product
- rustcAll versions (No fix recorded) | < 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 | < 1.53.0+dfsg1+llvm-4ubuntu1
5 vendors · 25 products
References
17 links- github.com/sickcodes/security/blob/master/advisories/SICK-2021-015.mdREPORTExploitThird Party Advisory
