Vulnerability Description
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Data\ | \ | <= 0.29, validate\ |
| Netapp | Snapcenter | - |
Related Weaknesses (CWE)
References
- https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ExploitThird Party Advisory
- https://github.com/houseabsolute/Data-Validate-IPProductThird Party Advisory
- https://github.com/houseabsolute/Data-Validate-IP/commit/3bba13c819d616514a75e08PatchThird Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-018.mdExploitThird Party Advisory
- https://security.netapp.com/advisory/ntap-20210604-0002/Third Party Advisory
- https://sick.codes/sick-2021-018/ExploitThird Party Advisory
- https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ExploitThird Party Advisory
- https://github.com/houseabsolute/Data-Validate-IPProductThird Party Advisory
- https://github.com/houseabsolute/Data-Validate-IP/commit/3bba13c819d616514a75e08PatchThird Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-018.mdExploitThird Party Advisory
- https://security.netapp.com/advisory/ntap-20210604-0002/Third Party Advisory
- https://sick.codes/sick-2021-018/ExploitThird Party Advisory
FAQ
What is CVE-2021-29662?
CVE-2021-29662 is a vulnerability with a CVSS score of 7.5 (HIGH). The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypas...
How severe is CVE-2021-29662?
CVE-2021-29662 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-29662?
Check the references section above for vendor advisories and patch information. Affected products include: Data\ \, Netapp Snapcenter.