In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
Fix
Patch, vendor advisory and mitigation references on NVD 18
- https://bugs.python.org/issue36384 Issue Tracking, Patch, Vendor Advisory
- https://docs.python.org/3/library/ipaddress.html Vendor Advisory
- https://github.com/python/cpython/pull/12577 Patch, Third Party Advisory
- https://github.com/python/cpython/pull/25099 Patch, Third Party Advisory
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html Vendor Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory
- https://bugs.python.org/issue36384 Issue Tracking, Patch, Vendor Advisory
- https://docs.python.org/3/library/ipaddress.html Vendor Advisory
- https://github.com/python/cpython/pull/12577 Patch, Third Party Advisory
- https://github.com/python/cpython/pull/25099 Patch, Third Party Advisory
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html Vendor Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · python, oracleNVD modified 2026-10-08 22:17
Affected (CPE criteria) 7
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.8.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:graalvm:20.3.2:*:*:*:enterprise:*:*:*cpe:2.3:a:oracle:graalvm:21.1.0:*:*:*:enterprise:*:*:*cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
References 33
- https://bugs.python.org/issue36384 Issue Tracking, Patch, Vendor Advisory
- https://docs.python.org/3/library/ipaddress.html Vendor Advisory
- https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst Third Party Advisory
- https://github.com/python/cpython/pull/12577 Patch, Third Party Advisory
- https://github.com/python/cpython/pull/25099 Patch, Third Party Advisory
- https://github.com/sickcodes Third Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md Exploit, Third Party Advisory
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html Vendor Advisory
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20210622-0003/ Third Party Advisory
- https://sick.codes/sick-2021-014 Exploit, Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory
- https://bugs.python.org/issue36384 Issue Tracking, Patch, Vendor Advisory
- https://docs.python.org/3/library/ipaddress.html Vendor Advisory
- https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst Third Party Advisory
- https://github.com/python/cpython/pull/12577 Patch, Third Party Advisory
- https://github.com/python/cpython/pull/25099 Patch, Third Party Advisory
- https://github.com/sickcodes Third Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html Vendor Advisory
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20210622-0003/ Third Party Advisory
- https://sick.codes/sick-2021-014 Exploit, Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory