CVE-2021-29662: Incorrect Type Cast
First published: Wed Mar 31 2021(Updated: )
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| data validate | <=0.29 | |
| NetApp SnapCenter |
Remedy
https://github.com/houseabsolute/Data-Validate-IP/commit/3bba13c819d616514a75e089badd75002fd4f14e
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/
- https://github.com/houseabsolute/Data-Validate-IP
- https://github.com/houseabsolute/Data-Validate-IP/commit/3bba13c819d616514a75e089badd75002fd4f14e
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-018.md
- https://security.netapp.com/advisory/ntap-20210604-0002/
- https://sick.codes/sick-2021-018/
Frequently Asked Questions
What is the severity of CVE-2021-29662?
CVE-2021-29662 is considered a medium severity vulnerability due to its potential to allow unauthorized access.
How do I fix CVE-2021-29662?
To fix CVE-2021-29662, update the Data::Validate::IP module to version 0.30 or later.
What type of attack can exploit CVE-2021-29662?
CVE-2021-29662 can be exploited to bypass IP address-based access controls.
Which software is affected by CVE-2021-29662?
The vulnerability affects the Data::Validate::IP module up to version 0.29 and potentially other software relying on it.
Can CVE-2021-29662 affect my server's security?
Yes, CVE-2021-29662 can compromise your server's security if IP-based access control mechanisms are utilized.
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- agent/author
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/data\
- canonical/data validate
- version/data validate/0.29
- vendor/netapp
- canonical/netapp snapcenter