« Volver al listado

CVE-2021-4456

Estado: AnalizadaMedia (6.5)—

Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.

The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.

The documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mrsam — Net\

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-4456",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-4456",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-27T16:52:58.903437Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "repo": "https://github.com/svarshavchik/Net-CIDR",
          "vendor": "MRSAM",
          "product": "Net::CIDR",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.24",
              "versionType": "custom"
            }
          ],
          "packageName": "Net-CIDR",
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "addr2cidr"
            },
            {
              "name": "cidrlookup"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-27T01:16:13.553",
  "references": [
    {
      "url": "https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://github.com/svarshavchik/Net-CIDR/commit/e3648c6bc6bdd018f90cca4149c467017d42bd10",
      "tags": [
        "Patch"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/dist/Net-CIDR/changes",
      "tags": [
        "Release Notes"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "description": [
        {
          "lang": "en",
          "value": "CWE-704"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.\n\nThe functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.\n\nThe documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe."
    },
    {
      "lang": "es",
      "value": "Las versiones de Net::CIDR anteriores a la 0.24 para Perl manejan incorrectamente los ceros iniciales en las direcciones IP CIDR, lo que puede tener un impacto no especificado.\n\nLas funciones `addr2cidr` y `cidrlookup` pueden devolver ceros iniciales en una cadena CIDR, que a su vez pueden ser interpretados como números octales por usuarios posteriores. En algunos casos, un atacante podría aprovechar esto para eludir los controles de acceso basados en direcciones IP.\n\nLa documentación aconseja validar cadenas CIDR no confiables con la función `cidrvalidate`. Sin embargo, esta mitigación es opcional y no se aplica por defecto. En la práctica, los usuarios pueden llamar a `addr2cidr` o `cidrlookup` con entrada no confiable y sin validación, asumiendo incorrectamente que esto es seguro."
    }
  ],
  "lastModified": "2026-06-17T04:19:47.703",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mrsam:net\\:\\:cidr:*:*:*:*:*:perl:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC282B37-1517-408A-A0E6-1A0D5A565B3E",
              "versionEndExcluding": "0.24"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
}