PT-2021-7695 · Unknown+1 · Net::Netmask+1

Published 2021-03-29 · Updated 2023-08-08 · CVE-2021-29424

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Net::Netmask versions prior to 2.0000

Description The issue is related to the improper handling of extraneous zero characters at the beginning of an IP address string, which can allow attackers to bypass access control based on IP addresses. This can potentially impact data integrity.

Recommendations For versions prior to 2.0000, update to version 2.0000 or later to resolve the issue. As a temporary workaround, consider implementing additional validation for IP address strings to prevent bypassing access control.

Exploit

Fix

Incorrect Authorization

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-863

CWE-704

Related Identifiers

BDU:2023-01669

CVE-2021-29424

MGASA-2021-0375

OPENSUSE-SU-2023:0215-1

OPENSUSE-SU-2023:0217-1

Affected Products

Astra Linux

Net::Netmask

References · 34

• 🔥 https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBJVLXJSWN6DKSF5ADUEERI6M23R3GGP · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7JIPQAY5OZ5D3DA7INQILU7SGHTHMWB · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0217-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29424 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29424 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-29424 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01669 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-29424 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0375 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0375.html · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JF4CYIZELC3NISB3RMV4OCI4GYBC557B · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-29424 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/CBJVLXJSWN6DKSF5ADUEERI6M23R3GGP · Vendor Advisory