IP Address Parsing Vulnerability in Rust Package - CVE-2021-29922
Summary
ALPINE-CVE-2021-29922: library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control tha... Affects rust versions < 1.52.1-r1. Fixed in 1.52.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rust is a systems programming language that emphasizes safety and performance. It is widely used for building reliable and efficient software. The vulnerability in question affects the standard library's networking parser, which is responsible for interpreting IP address strings. This issue arises from improper handling of leading zero characters in IP address strings, potentially leading to security flaws in applications relying on this functionality.
Vulnerability Detail
The vulnerability identified as CVE-2021-29922 exists in the Rust programming language's standard library, specifically in the net parser module. Prior to version 1.53.0, the library fails to correctly handle extraneous zero characters at the beginning of an IP address string. This oversight can allow attackers to bypass access controls that depend on IP address validation, leading to unauthorized access in certain scenarios. The vulnerability has a CVSS score of 9.1, indicating a critical severity level.
How To Fix
Minimum fixed version
1.52.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade rustTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional validation checks in their applications to sanitize IP address inputs, ensuring that leading zeroes do not affect the interpretation of the address. This can be done by stripping leading zeroes before processing the IP address.
Conclusion
CVE-2021-29922 is a critical vulnerability in the Rust programming language's standard library that can lead to unauthorized access due to improper IP address parsing. It is crucial for developers using Rust to update their packages to the patched version and implement additional validation measures to secure their applications.
See every vulnerability recorded for rust →
FAQ
CVE-2021-29922 is a vulnerability in the Rust programming language's standard library that allows attackers to bypass IP address-based access controls due to improper handling of leading zero characters.
If your application relies on Rust's networking capabilities for IP address validation, it may be susceptible to unauthorized access if the vulnerability is exploited.
The CVSS score for CVE-2021-29922 is 9.1, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the Rust package to version 1.52.1-r1 or later to mitigate the vulnerability. Additionally, consider implementing input validation to further enhance security.
References
Related vulnerabilities
Recent vulnerabilities recorded for rust.
