UBUNTU-CVE-2021-47154

Details

The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

Affected Packages

libnet-cidr-lite-perl

Ubuntu 20.04 LTS

Fixed in:

0.21-2ubuntu0.1

libnet-cidr-lite-perl

Ubuntu Pro 16.04 LTS

Fixed in:

0.21-1ubuntu0.16.04.1~esm1

libnet-cidr-lite-perl

Ubuntu Pro 18.04 LTS

Fixed in:

0.21-1ubuntu0.18.04.1~esm1

References

REPORT

https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/

REPORT

https://ubuntu.com/security/CVE-2021-47154

ADVISORY

https://ubuntu.com/security/notices/USN-6712-1

ADVISORY

https://ubuntu.com/security/notices/USN-8406-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2021-47154