CVE Vulnerabilities

CVE-2021-29424

Incorrect Type Conversion or Cast

Published: Apr 06, 2021 | Modified: Nov 07, 2023
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

Weakness

The product does not correctly convert an object, resource, or structure from one type to a different type.

Affected Software

Name Vendor Start Version End Version
Net::netmask Net::netmask_project * 2.0000 (excluding)
Libnet-netmask-perl Ubuntu bionic *
Libnet-netmask-perl Ubuntu esm-apps/bionic *
Libnet-netmask-perl Ubuntu esm-apps/focal *
Libnet-netmask-perl Ubuntu esm-apps/xenial *
Libnet-netmask-perl Ubuntu focal *
Libnet-netmask-perl Ubuntu groovy *
Libnet-netmask-perl Ubuntu hirsute *
Libnet-netmask-perl Ubuntu trusty *
Libnet-netmask-perl Ubuntu upstream *
Libnet-netmask-perl Ubuntu xenial *
Libnetwork-ipv4addr-perl Ubuntu bionic *
Libnetwork-ipv4addr-perl Ubuntu devel *
Libnetwork-ipv4addr-perl Ubuntu esm-apps/bionic *
Libnetwork-ipv4addr-perl Ubuntu esm-apps/focal *
Libnetwork-ipv4addr-perl Ubuntu esm-apps/jammy *
Libnetwork-ipv4addr-perl Ubuntu esm-apps/noble *
Libnetwork-ipv4addr-perl Ubuntu esm-apps/xenial *
Libnetwork-ipv4addr-perl Ubuntu focal *
Libnetwork-ipv4addr-perl Ubuntu groovy *
Libnetwork-ipv4addr-perl Ubuntu hirsute *
Libnetwork-ipv4addr-perl Ubuntu impish *
Libnetwork-ipv4addr-perl Ubuntu jammy *
Libnetwork-ipv4addr-perl Ubuntu kinetic *
Libnetwork-ipv4addr-perl Ubuntu lunar *
Libnetwork-ipv4addr-perl Ubuntu mantic *
Libnetwork-ipv4addr-perl Ubuntu noble *
Libnetwork-ipv4addr-perl Ubuntu oracular *
Libnetwork-ipv4addr-perl Ubuntu trusty *
Libnetwork-ipv4addr-perl Ubuntu upstream *
Libnetwork-ipv4addr-perl Ubuntu xenial *

References