CVE-2021-4456

The functions addr2cidr and cidrlookup may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.

The documentation advises validating untrusted CIDR strings with the cidrvalidate function. However, this mitigation is optional and not enforced by default. In practice, users may call addr2cidr or cidrlookup with untrusted input and without validation, incorrectly assuming that this is safe.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:mrsam:net\\:\\:cidr:*:*:*:*:*:perl:*:*"
            ],
            "extracted_events": [
                {
                    "fixed": "0.24"
                }
            ],
            "source": "CPE_RANGE",
            "vendor_product": "mrsam:net::cidr"
        },
        {
            "extracted_events": [
                {
                    "fixed": "0.24"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/svarshavchik/net-cidr

Affected ranges

Type

GIT

Repo

https://github.com/svarshavchik/net-cidr

Events

Introduced

Fixed

e3648c6bc6bdd018f90cca4149c467017d42bd10

Database specific

Show details

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-4456.json"