EXPOSURES › CVE-2021-29921
CVE-2021-29921
CRITICAL
DETAIL
SourceNVD · cve
Published2021-05-06
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2021-29921 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
Oracle · vendorpython · vendorcommunications cloud native core automated test suite · productcommunications cloud native core binding support function · productcommunications cloud native core network slice selection function · productgraalvm · productpython · productzfs storage appliance kit · product
DESCRIPTION
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
AFFECTED FEDRAMP PRODUCTS · 10
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |