.. _ipaddress-ipv4-leading-zeros:

ipaddress leading zeros in IPv4 address
=======================================

.. warning::
    This resource is maintained for historical reference and **does not contain the latest vulnerability info for Python**.

    The `canonical database for vulnerabilities affecting Python <https://github.com/psf/advisory-database>`_ is available on GitHub
    in the Open Source Vulnerability (OSV) format. This vulnerability can be viewed online at the
    `Open Source Vulnerability Database <https://osv.dev/list?ecosystem=&q=CVE-2021-29921>`_.

The ipaddress module accepts leading zeros in IPv4 addresses.

Python 3.8 as modified in `bpo-36384 <https://bugs.python.org/issue36384>`_
to accept leading zeros. The vulnerability was made public `in a comment
of the issue <https://bugs.python.org/issue36384#msg389826>`_.

Python 3.8 is left unchanged (accept leading zeros). Python 3.7 and older
are not affected.

Vulnerability discovered and reported the same day by two persons:
George-Cristian Bîrzan and Felipe Rodrigues.

Dates:

* Disclosure date: **2021-03-30** (comment on bpo-36384)
* Reported at: 2021-03-30
* Reported by: George-Cristian Bîrzan, Felipe Rodrigues (emails to the PSRT list)

Fixed In
--------

* Python **3.8.12** (2021-08-30) fixed by `commit 03dd89d (branch 3.8) <https://github.com/python/cpython/commit/03dd89d62413c4a92831ed1b36e2ae8983bcb2d4>`_ (2021-08-17)
* Python **3.9.5** (2021-05-03) fixed by `commit 5374fbc (branch 3.9) <https://github.com/python/cpython/commit/5374fbc31446364bf5f12e5ab88c5493c35eaf04>`_ (2021-05-02)
* Python **3.10.0** (2021-10-04) fixed by `commit 60ce8f0 (branch 3.10) <https://github.com/python/cpython/commit/60ce8f0be6354ad565393ab449d8de5d713f35bc>`_ (2021-05-02)

CVE-2021-29921
--------------

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.

* CVE ID: `CVE-2021-29921 <https://nvd.nist.gov/vuln/detail/CVE-2021-29921/>`_
* Published: 2021-05-06
* `CVSS Score <https://nvd.nist.gov/cvss.cfm>`_: 7.5

Timeline
--------

Timeline using the disclosure date **2021-03-30** as reference:

* 2021-03-30: Reported
* 2021-03-30: Disclosure date (comment on bpo-36384)
* 2021-05-02 (**+33 days**): `commit 5374fbc (branch 3.9) <https://github.com/python/cpython/commit/5374fbc31446364bf5f12e5ab88c5493c35eaf04>`_
* 2021-05-02 (**+33 days**): `commit 60ce8f0 (branch 3.10) <https://github.com/python/cpython/commit/60ce8f0be6354ad565393ab449d8de5d713f35bc>`_
* 2021-05-03 (**+34 days**): Python 3.9.5 released
* 2021-05-06 (**+37 days**): CVE-2021-29921 published
* 2021-08-17 (**+140 days**): `commit 03dd89d (branch 3.8) <https://github.com/python/cpython/commit/03dd89d62413c4a92831ed1b36e2ae8983bcb2d4>`_
* 2021-08-30 (**+153 days**): Python 3.8.12 released
* 2021-10-04: Python 3.10.0 released

Links
-----

* https://sick.codes/sick-2021-014