by Kastro
Paper/Archive/CVE-2021-29922

CVE-2021-29922

mitre — library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP addre…

EPSS 3%CVSS 9.1
critical.is priorityof 100
44
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 85.5.855 × 2017.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

refdoc.rust-lang.org/beta/std/net/struct.Ipv4Addr.htmlrefgithub.com/rust-lang/rust/pull/83652refgithub.com/rust-lang/rust/issues/83648refgithub.com/sickcodes/security/blob/master/advisories/SICK-2021-015.mdrefdefcon.org/html/defcon-29/dc-29-speakers.html#kaoudisadvisorysecurity.gentoo.org/glsa/202210-09