crítica
CVE-2021-29922
rust: incorrect parsing of extraneous zero characters at the beginning of an IP address string
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Red Hat7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Photon OS. Más baja según Red Hat (media), AlmaLinux (media), Oracle (media), Rocky Linux (media), Ubuntu (media).
Descripción
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 3.0 | rust | 1.51.0-4.ph3 |
| Photon OS 4.0 | rust | 1.51.0-4.ph4 |
| alma 8 | rust-toolset:rhel8::rust-toolset | 1.54.0-1.module_el8.5.0+2599+d655d86c |
| alpine 3.14 | rust | 1.52.1-r1 |
| alpine 3.15 | rust | 1.52.1-r1 |
| alpine 3.16 | rust | 1.52.1-r1 |
| alpine 3.17 | rust | 1.52.1-r1 |
| alpine 3.18 | rust | 1.52.1-r1 |
| alpine 3.19 | rust | 1.52.1-r1 |
| alpine 3.20 | rust | 1.52.1-r1 |
| alpine 3.21 | rust | 1.52.1-r1 |
| alpine 3.22 | rust | 1.52.1-r1 |
Mostrar las 62 entradas de 30 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 3.0 | rust | 1.51.0-4.ph3 |
| Photon OS 4.0 | rust | 1.51.0-4.ph4 |
| alma 8 | rust-toolset:rhel8::rust-toolset | 1.54.0-1.module_el8.5.0+2599+d655d86c |
| alpine 3.14 | rust | 1.52.1-r1 |
| alpine 3.15 | rust | 1.52.1-r1 |
| alpine 3.16 | rust | 1.52.1-r1 |
| alpine 3.17 | rust | 1.52.1-r1 |
| alpine 3.18 | rust | 1.52.1-r1 |
| alpine 3.19 | rust | 1.52.1-r1 |
| alpine 3.20 | rust | 1.52.1-r1 |
| alpine 3.21 | rust | 1.52.1-r1 |
| alpine 3.22 | rust | 1.52.1-r1 |
| alpine 3.23 | rust | 1.52.1-r1 |
| alpine 3.24 | chromium-rust | 1.52.1-r1 |
| alpine 3.24 | rust | 1.52.1-r1 |
| alpine edge | rust | 1.52.1-r1 |
| debian 10 | rustc | sin corrección indicada |
| debian 11 | rustc | sin corrección indicada |
| debian 12 | rustc | 1.53.0+dfsg1-1 |
| debian 13 | rustc | 1.53.0+dfsg1-1 |
| debian 14 | rustc | 1.53.0+dfsg1-1 |
| debian 9 | rustc | sin corrección indicada |
| echo | rustc | 1.53.0+dfsg1-1 |
| Oracle Linux 8 | cargo | 1.54.0-2.module+el8.5.0+20381+6e029bfc |
| Oracle Linux 8 | cargo-doc | 1.54.0-2.module+el8.5.0+20381+6e029bfc |
| Oracle Linux 8 | clippy | 1.54.0-2.module+el8.5.0+20381+6e029bfc |
| Oracle Linux 8 | rls | 1.54.0-2.module+el8.5.0+20381+6e029bfc |
| Oracle Linux 8 | rust | 1.54.0-2.module+el8.5.0+20381+6e029bfc |
| Oracle Linux 8 | rust-analysis | 1.54.0-2.module+el8.5.0+20381+6e029bfc |
| Oracle Linux 8 | rust-debugger-common | 1.54.0-2.module+el8.5.0+20381+6e029bfc |
| Oracle Linux 8 | rust-doc | 1.54.0-2.module+el8.5.0+20381+6e029bfc |
| Oracle Linux 8 | rust-gdb | 1.54.0-2.module+el8.5.0+20381+6e029bfc |
| Oracle Linux 8 | rust-lldb | 1.54.0-2.module+el8.5.0+20381+6e029bfc |
| Oracle Linux 8 | rust-src | 1.54.0-2.module+el8.5.0+20381+6e029bfc |
| Oracle Linux 8 | rust-std-static | 1.54.0-2.module+el8.5.0+20381+6e029bfc |
| Oracle Linux 8 | rust-std-static-wasm32-unknown-unknown | 1.54.0-2.module+el8.5.0+20381+6e029bfc |
| Oracle Linux 8 | rust-toolset | 1.54.0-1.module+el8.5.0+20381+6e029bfc |
| Oracle Linux 8 | rustfmt | 1.54.0-2.module+el8.5.0+20381+6e029bfc |
| rapidfort ubuntu 20.04 | rf-rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1 |
| rapidfort ubuntu 20.04 | rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1, 0:1.68.0+dfsg0ubuntu1-0ubuntu1 |
| rapidfort ubuntu 22.04 | rf-rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1 |
| rapidfort ubuntu 22.04 | rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1, 0:1.68.0+dfsg0ubuntu1-0ubuntu1 |
| rapidfort ubuntu 24.04 | rf-rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1 |
| rapidfort ubuntu 24.04 | rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1, 0:1.68.0+dfsg0ubuntu1-0ubuntu1 |
| rocky 8 | rust-toolset:rhel8::cargo | 1.54.0-2.module+el8.5.0+678+cf7bc64b |
| rocky 8 | rust-toolset:rhel8::cargo-doc | 1.54.0-2.module+el8.5.0+678+cf7bc64b |
| rocky 8 | rust-toolset:rhel8::clippy | 1.54.0-2.module+el8.5.0+678+cf7bc64b |
| rocky 8 | rust-toolset:rhel8::rls | 1.54.0-2.module+el8.5.0+678+cf7bc64b |
| rocky 8 | rust-toolset:rhel8::rust | 1.54.0-2.module+el8.5.0+678+cf7bc64b |
| rocky 8 | rust-toolset:rhel8::rust-analysis | 1.54.0-2.module+el8.5.0+678+cf7bc64b |
| rocky 8 | rust-toolset:rhel8::rust-debugger-common | 1.54.0-2.module+el8.5.0+678+cf7bc64b |
| rocky 8 | rust-toolset:rhel8::rust-doc | 1.54.0-2.module+el8.5.0+678+cf7bc64b |
| rocky 8 | rust-toolset:rhel8::rust-gdb | 1.54.0-2.module+el8.5.0+678+cf7bc64b |
| rocky 8 | rust-toolset:rhel8::rust-lldb | 1.54.0-2.module+el8.5.0+678+cf7bc64b |
| rocky 8 | rust-toolset:rhel8::rust-src | 1.54.0-2.module+el8.5.0+678+cf7bc64b |
| rocky 8 | rust-toolset:rhel8::rust-std-static | 1.54.0-2.module+el8.5.0+678+cf7bc64b |
| rocky 8 | rust-toolset:rhel8::rust-std-static-wasm32-unknown-unknown | 1.54.0-2.module+el8.5.0+678+cf7bc64b |
| rocky 8 | rust-toolset:rhel8::rust-toolset | 1.54.0-1.module+el8.5.0+678+cf7bc64b |
| rocky 8 | rust-toolset:rhel8::rustfmt | 1.54.0-2.module+el8.5.0+678+cf7bc64b |
| ubuntu 20.04 | rustc | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 |
| ubuntu 20.04-ESM | rustc | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 |
| ubuntu 22.04 | rustc | 1.53.0+dfsg1+llvm-4ubuntu1 |
Referencias
- https://access.redhat.com/errata/RHSA-2021:4270
- https://access.redhat.com/security/cve/CVE-2021-29922
- https://bugzilla.redhat.com/show_bug.cgi?id=1991962
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29922
- https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis
- https://doc.rust-lang.org/beta/std/net/struct.Ipv4Addr.html
- https://errata.rockylinux.org/RLSA-2021:4270
Las 16 referencias
- https://github.com/rust-lang/rust/issues/83648
- https://github.com/rust-lang/rust/pull/83652
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-015.md
- https://linux.oracle.com/cve/CVE-2021-29922.html
- https://linux.oracle.com/errata/ELSA-2021-4270.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-29922
- https://security.gentoo.org/glsa/202210-09
- https://www.cve.org/CVERecord?id=CVE-2021-29922