p PatchFirst

CVE-2021-29922

CVE-2021-29922

This page contains facts from public vulnerability sources. Check the original advisory before updating.

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

CVSS 9.1 · Critical · EPSS 2.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • rustc Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.53.0+dfsg1-1

    Update to 1.53.0+dfsg1-1

  • rustc Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.53.0+dfsg1-1

    Update to 1.53.0+dfsg1-1

  • rustc Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.53.0+dfsg1-1

    Update to 1.53.0+dfsg1-1

  • rustc Ubuntu:Pro:14.04:LTS

    Versions
    • 1.15.1+dfsg0-1~exp1ubuntu2~14.04.7
    • 1.17.0+dfsg2-8~ubuntu0.14.04.3
    • 1.21.0+dfsg1+llvm-0ubuntu3~14.04.5
    • 1.22.1+dfsg1+llvm-0ubuntu2~14.04.2
    • 1.24.1+dfsg1+llvm-0ubuntu1~14.04.1
    • 1.25.0+dfsg1+llvm-0ubuntu1~14.04.1
    • 1.28.0+dfsg1+llvm-0ubuntu1~14.04.1
    • 1.30.0+dfsg1+llvm-2ubuntu1~14.04.1
    • 1.31.0+dfsg1+llvm-2ubuntu1~14.04.1
    • 1.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rustc Ubuntu:Pro:16.04:LTS

    Versions
    • 1.7.0+dfsg1-1
    • 1.15.1+dfsg0-1~exp1ubuntu2~16.04.3
    • 1.17.0+dfsg2-8~ubuntu0.16.04.2
    • 1.21.0+dfsg1+llvm-0ubuntu3~16.04.1
    • 1.22.1+dfsg1+llvm-0ubuntu2~16.04.2
    • 1.24.1+dfsg1+llvm-0ubuntu1~16.04.1
    • 1.25.0+dfsg1+llvm-0ubuntu1~16.04.1
    • 1.28.0+dfsg1+llvm-0ubuntu1~16.04.1
    • 1.30.0+dfsg1+llvm-2ubuntu1~16.04.1
    • 1.31.0+dfsg1+llvm-2ubuntu1~16.04.1
    • 1.32.0+dfsg1+llvm-1ubuntu1~16.04.1
    • 1.34.1+dfsg2+llvm-0ubuntu1~16.04.1
    • 1.35.0+dfsg0.1+llvm-0ubuntu1~16.04.1
    • 1.36.0+dfsg1+llvm-2ubuntu1~16.04.1
    • 1.37.0+dfsg1+llvm-1ubuntu1~16.04.1
    • 1.39.0+dfsg1+llvm-3ubuntu1~16.04.1
    • 1.41.0+dfsg1+llvm-0ubuntu1~16.04.1
    • 1.43.0+dfsg1+llvm-1~exp1ubuntu2~16.04.1
    • 1.47.0+dfsg1+llvm-1ubuntu1~16.04.1
    • 1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rustc Ubuntu:20.04:LTS

    Versions
    • 1.37.0+dfsg1+llvm-1ubuntu1
    • 1.38.0+dfsg0.2+llvm-0ubuntu1
    • 1.38.0+dfsg0.2+llvm-0ubuntu2
    • 1.39.0+dfsg1+llvm-3ubuntu1
    • 1.40.0+dfsg1+llvm-5ubuntu1
    • 1.41.0+dfsg1+llvm-0ubuntu1
    • 1.41.0+dfsg1+llvm-0ubuntu2
    • 1.43.0+dfsg1+llvm-1~exp1ubuntu1~20.04.1
    • 1.47.0+dfsg1+llvm-1ubuntu1~20.04.1
    • 1.51.0+dfsg1+llvm-1~exp3ubuntu1~20.04.2
    Affected ranges
    • ECOSYSTEM: < 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1

    Update to 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1

  • rustc Ubuntu:22.04:LTS

    Versions
    • 1.51.0+dfsg1+llvm-1~exp3ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1.53.0+dfsg1+llvm-4ubuntu1

    Update to 1.53.0+dfsg1+llvm-4ubuntu1

Original sources

Check your server →