Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 779172 (CVE-2021-29424)

Summary: <dev-perl/Net-CIDR-Lite-0.220.0: octal type confusion with leading zeros in IP octets
Product: Gentoo Security Reporter: Hank Leininger <hlein>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: IN_PROGRESS ---    
Severity: minor CC: ajak, jstein, sam
Priority: Normal Keywords: PullRequest
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/
See Also: https://github.com/gentoo/gentoo/pull/20773
https://bugs.gentoo.org/show_bug.cgi?id=779373
Whiteboard: B4 [glsa?]
Package list:
Runtime testing required: ---
Bug Depends on: 801610    
Bug Blocks:    

Description Hank Leininger 2021-03-29 21:34:56 UTC 
Similar to https://bugs.gentoo.org/779163, Net::CIDR::Lite will accept IP octets with leading zeros and parse them as decimal, although system libraries will consider them to be octal.

It refuses 4-digit octets, so for instance 0127.0.0.1 results in an error. But a <=3 digit octet can be misinterpreted:

$ perl -MNet::CIDR::Lite -e 'my $cidr = Net::CIDR::Lite->new; $cidr->add("172.016.0.1/32"); print $cidr->list, "\n"'
172.16.0.1/32

Vs:

$ ping 172.016.0.1
PING 172.016.0.1 (172.14.0.1) 56(84) bytes of data.

Net::CIDR has a Net::CIDR::validate() function, which the documentation says should always be called first; it correctly flags such cases. But Net::CIDR::Lite has no such validator.
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-05-11 22:13:15 UTC 
*** Bug 779163 has been marked as a duplicate of this bug. ***
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-05-11 23:16:39 UTC 
*** Bug 779373 has been marked as a duplicate of this bug. ***
Comment 3 Larry the Git Cow gentoo-dev 2021-05-13 14:39:27 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a86b572696457f90b11af9a476f384f155341782

commit a86b572696457f90b11af9a476f384f155341782
Author:     Andreas K. Hüttel <dilfridge@gentoo.org>
AuthorDate: 2021-05-13 14:39:11 +0000
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: 2021-05-13 14:39:11 +0000

    dev-perl/Net-CIDR-Lite: Version bump 0.22
    
    Bug: https://bugs.gentoo.org/779172
    Package-Manager: Portage-3.0.18, Repoman-3.0.2
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 dev-perl/Net-CIDR-Lite/Manifest                    |  1 +
 .../Net-CIDR-Lite/Net-CIDR-Lite-0.220.0.ebuild     | 23 ++++++++++++++++++++++
 2 files changed, 24 insertions(+)
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-07-16 23:22:19 UTC 
Please cleanup.
Comment 5 NATTkA bot gentoo-dev 2021-07-29 17:23:24 UTC Comment hidden (obsolete)
Comment 6 NATTkA bot gentoo-dev 2021-07-29 17:31:47 UTC Comment hidden (obsolete)
Comment 7 NATTkA bot gentoo-dev 2021-07-29 17:39:41 UTC Comment hidden (obsolete)
Comment 8 NATTkA bot gentoo-dev 2021-07-29 17:47:52 UTC Comment hidden (obsolete)
Comment 9 NATTkA bot gentoo-dev 2021-07-29 18:03:49 UTC Comment hidden (obsolete)
Comment 10 NATTkA bot gentoo-dev 2021-07-29 18:12:07 UTC 
Package list is empty or all packages have requested keywords.
Comment 11 Larry the Git Cow gentoo-dev 2021-07-31 18:02:46 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=069c0f2aafbe6113c3edea6e8a03026799def386

commit 069c0f2aafbe6113c3edea6e8a03026799def386
Author:     Andreas K. Hüttel <dilfridge@gentoo.org>
AuthorDate: 2021-07-31 18:02:23 +0000
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: 2021-07-31 18:02:35 +0000

    dev-perl/Net-CIDR-Lite: Remove old
    
    Bug: https://bugs.gentoo.org/779172
    Package-Manager: Portage-3.0.20, Repoman-3.0.3
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 dev-perl/Net-CIDR-Lite/Manifest                    |  1 -
 .../Net-CIDR-Lite/Net-CIDR-Lite-0.210.0-r1.ebuild  | 22 ----------------------
 2 files changed, 23 deletions(-)