CVE-2021-29921: Python ipaddress Auth Bypass Vulnerability

CVE-2021-29921 Overview

CVE-2021-29921 is a critical input validation vulnerability in Python's ipaddress library affecting versions before 3.9.5. The library mishandles leading zero characters in the octets of an IP address string, which can allow attackers to bypass access control mechanisms that rely on IP address validation. This vulnerability stems from ambiguous interpretation of octal versus decimal notation in IP address octets.

Critical Impact

Attackers can bypass IP-based access control lists and security restrictions by crafting malformed IP addresses with leading zeros, potentially gaining unauthorized access to restricted resources or systems.

Affected Products

• Python versions before 3.8.12, 3.9.x before 3.9.5, and 3.10.x before 3.10.0a7
• Oracle Communications Cloud Native Core Automated Test Suite 1.8.0
• Oracle Communications Cloud Native Core Binding Support Function 1.11.0
• Oracle Communications Cloud Native Core Network Slice Selection Function 1.8.0
• Oracle GraalVM Enterprise Edition 20.3.2 and 21.1.0
• Oracle ZFS Storage Appliance Kit 8.8

Discovery Timeline

• 2021-05-06 - CVE CVE-2021-29921 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2021-29921

Vulnerability Analysis

The vulnerability exists in Python's ipaddress standard library module, which provides capabilities for creating, manipulating, and performing operations on IPv4 and IPv6 addresses and networks. The core issue lies in how the library parses IP address strings that contain leading zeros in their octets.

When an IP address contains leading zeros (e.g., 010.8.8.8), the ipaddress library inconsistently handles these values. While POSIX and many other systems interpret leading zeros as octal notation (where 010 equals decimal 8), Python's ipaddress library strips leading zeros and interprets the remaining value as decimal. This discrepancy creates a parsing inconsistency that can be exploited to bypass IP-based security controls.

For example, an attacker could submit an IP address like 0127.0.0.1 which Python's ipaddress library would interpret as 127.0.0.1 (localhost), while other systems might interpret it differently or reject it entirely. This allows attackers to craft specially formatted IP addresses that pass validation checks but resolve to unintended destinations.

Root Cause

The root cause is improper input validation in the ipaddress.IPv4Address and related classes. The library accepts leading zeros in IP address octets without properly handling the ambiguity between octal and decimal interpretation. According to IETF RFC 3986 and POSIX standards, leading zeros typically indicate octal notation, but Python's implementation inconsistently strips these zeros and treats the value as decimal.

The _ip_int_from_string() function in the ipaddress module fails to reject or properly convert octets with leading zeros, creating a semantic gap between what Python interprets and what other network components may interpret.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying an application that uses Python's ipaddress library for IP-based access control or validation
2. Crafting IP addresses with leading zeros that will be interpreted differently by the target application versus other network components
3. Submitting these malformed IP addresses to bypass access restrictions, allowlists, or blocklists

For instance, if an application maintains an allowlist that permits 127.0.0.1, an attacker could submit 0127.0.0.1 which might bypass a regex-based initial filter but still be interpreted as localhost by the vulnerable ipaddress library, effectively bypassing the intended security control.

The vulnerability is particularly dangerous in scenarios involving Server-Side Request Forgery (SSRF) protections, where applications attempt to block requests to internal IP ranges using the ipaddress library for validation.

Detection Methods for CVE-2021-29921

Indicators of Compromise

• Web application logs showing IP addresses with unusual leading zero patterns (e.g., 010.0.0.1, 0127.0.0.1)
• Network traffic containing malformed IP addresses in request parameters, headers, or payloads
• Access logs indicating successful connections from IP addresses that should have been blocked by access control lists
• Application errors or anomalies related to IP address parsing in Python applications

Detection Strategies

• Implement regex patterns to detect IP addresses containing octets with leading zeros in incoming requests
• Review web application firewall (WAF) logs for patterns matching 0[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
• Audit Python applications to identify usage of the ipaddress library for security-critical IP validation
• Deploy SIEM rules to alert on network requests containing malformed IP address formats

Monitoring Recommendations

• Enable verbose logging for applications performing IP-based access control decisions
• Monitor for unexpected access to internal resources from applications that implement SSRF protections
• Configure alerting for IP validation failures or parsing anomalies in security-critical components
• Regularly audit access control bypass attempts in web application logs

How to Mitigate CVE-2021-29921

Immediate Actions Required

• Upgrade Python to version 3.8.12, 3.9.5, 3.10.0a7, or later to receive the patched ipaddress library
• Implement additional input validation to reject IP addresses containing leading zeros before passing to ipaddress library
• Review and audit all applications using Python's ipaddress module for IP-based security controls
• Apply vendor patches for affected Oracle products as documented in Oracle Critical Patch Updates

Patch Information

The vulnerability has been addressed in multiple Python releases. The fix ensures that IP addresses with leading zeros are properly rejected with a ValueError rather than being silently normalized. Patches are available through the following resources:

• Python Pull Request 12577 - Initial fix implementation
• Python Pull Request 25099 - Additional improvements
• Python Issue Tracker Report - Bug tracking and discussion
• Oracle CPU July 2021 Security Alert - Oracle product patches

For detailed vulnerability information, refer to the Python Security IPv4 Vulnerability Report.

Workarounds

• Implement a pre-validation layer that explicitly rejects IP addresses with leading zeros using regex: ^0[0-9]|\.0[0-9]
• Use alternative IP validation libraries that correctly handle octal notation until patches can be applied
• Deploy WAF rules to block requests containing IP addresses with leading zero octets
• Implement defense-in-depth by combining multiple validation methods rather than relying solely on ipaddress library

# Configuration example - Pre-validation regex to reject leading zeros
# Add to application input validation before calling ipaddress module
# Python example for input validation:
# import re
# if re.search(r'(^|\.)0[0-9]', ip_string):
#     raise ValueError("IP addresses with leading zeros are not permitted")