VulnerabilityDeferred
CVE-2021-47156
The Net::IPAddress::Util module before 5.000 for Perl does not properly consider extraneous zero characters in an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
MEDIUM 6.5EPSS 0.45%
Does this matter?
Lower severity and a low EPSS score (0.45%). Track it; it rarely justifies an emergency change on its own.
Description
The Net::IPAddress::Util module before 5.000 for Perl does not properly consider extraneous zero characters in an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 0.45% probability · 38th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1287
- Source
- cve@mitre.org
References
- https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/
- https://metacpan.org/release/Net-IPAddress-Util
- https://metacpan.org/release/PWBENNETT/Net-IPAddress-Util-5.000/changes
- https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/
- https://metacpan.org/release/Net-IPAddress-Util
- https://metacpan.org/release/PWBENNETT/Net-IPAddress-Util-5.000/changes
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.