NVD Vulnerability Detail

CVE-2021-29662

Summary	The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
Publication Date	April 1, 2021, 3:15 a.m.
Registration Date	April 1, 2021, 10:04 a.m.
Last Update	Nov. 21, 2024, 3:01 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:data\:\:validate\:\:ip_project:data\:\:validate\:\:ip::::::perl::*			0.29

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:netapp:snapcenter:-:::::::*

Related information, measures and tools

No	URL	タグ
1	https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/	Exploit Third Party Advisory
2	https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/	Exploit Third Party Advisory
3	https://github.com/houseabsolute/Data-Validate-IP	Product Third Party Advisory
4	https://github.com/houseabsolute/Data-Validate-IP	Product Third Party Advisory
5	https://github.com/houseabsolute/Data-Validate-IP/commit/3bba13c819d616514a75e089badd75002fd4f14e	Patch Third Party Advisory
6	https://github.com/houseabsolute/Data-Validate-IP/commit/3bba13c819d616514a75e089badd75002fd4f14e	Patch Third Party Advisory
7	https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-018.md	Exploit Third Party Advisory
8	https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-018.md	Exploit Third Party Advisory
9	https://security.netapp.com/advisory/ntap-20210604-0002/	Third Party Advisory
10	https://security.netapp.com/advisory/ntap-20210604-0002/	Third Party Advisory
11	https://sick.codes/sick-2021-018/	Exploit Third Party Advisory
12	https://sick.codes/sick-2021-018/	Exploit Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-704	不正な型変換またはキャスト	https://cwe.mitre.org/data/definitions/704.html

JVN Vulnerability Information

Perl 用 Data::Validate::IP モジュールにおける不正な認証に関する脆弱性

Title	Perl 用 Data::Validate::IP モジュールにおける不正な認証に関する脆弱性
Summary	Perl 用 Data::Validate::IP モジュールには、不正な認証に関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 30, 2021, midnight
Registration Date	Dec. 9, 2021, 3:43 p.m.
Last Update	Dec. 9, 2021, 3:43 p.m.

Affected System

Data::Validate::IP project

Data::Validate::IP 0.29 まで

NetApp

SnapCenter

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-29662	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29662
National Vulnerability Database (NVD)
2	CVE-2021-29662	https://nvd.nist.gov/vuln/detail/CVE-2021-29662

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-863	https://cwe.mitre.org/data/definitions/863.html

ベンダー情報

No	Name	URL
GitHub
1	Data-Validate-IP	https://github.com/houseabsolute/Data-Validate-IP
2	Update security note in docs to include mention of is_ip() and friends	https://github.com/houseabsolute/Data-Validate-IP/commit/3bba13c819d616514a75e089badd75002fd4f14e
NetApp Advisory
3	NTAP-20210604-0002	https://security.netapp.com/advisory/ntap-20210604-0002/

Change Log

No	Changed Details	Date of change
1	[2021年12月09日] 掲載	Dec. 9, 2021, 3:43 p.m.