CVE-2021-29424

Published: Apr 6, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

Affected (4)

Products: Net\: \ · Fedoraproject: Fedora

Net\

1 product

Fedoraproject

1 product

Fedora

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Net\ \	Before 2.0000

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33
Fedoraproject Fedora	Version 34

Related CWEs

CWE-704

Incorrect Type Conversion or Cast

The product does not correctly convert an object, resource, or structure from one type to a different type.

References (12)

https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/

Source: cve@mitre.org

ExploitThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBJVLXJSWN6DKSF5ADUEERI6M23R3GGP/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JF4CYIZELC3NISB3RMV4OCI4GYBC557B/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7JIPQAY5OZ5D3DA7INQILU7SGHTHMWB/

Source: cve@mitre.org

https://metacpan.org/changes/distribution/Net-Netmask#L11-22

Source: cve@mitre.org

Release NotesThird Party Advisory

https://security.netapp.com/advisory/ntap-20210604-0007/

Source: cve@mitre.org

Third Party Advisory

https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/