Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 779172 (CVE-2021-29424) - <dev-perl/Net-CIDR-Lite-0.220.0: octal type confusion with leading zeros in IP octets
Summary: <dev-perl/Net-CIDR-Lite-0.220.0: octal type confusion with leading zeros in I...
Status: IN_PROGRESS
Alias: CVE-2021-29424
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL: https://blog.urth.org/2021/03/29/secu...
Whiteboard: B4 [glsa?]
Keywords: PullRequest
: 779373 (view as bug list)
Depends on: 801610
Blocks:
  Show dependency tree
 
Reported: 2021-03-29 21:34 UTC by Hank Leininger
Modified: 2024-03-03 22:05 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Hank Leininger 2021-03-29 21:34:56 UTC 
Similar to https://bugs.gentoo.org/779163, Net::CIDR::Lite will accept IP octets with leading zeros and parse them as decimal, although system libraries will consider them to be octal.

It refuses 4-digit octets, so for instance 0127.0.0.1 results in an error. But a <=3 digit octet can be misinterpreted:

$ perl -MNet::CIDR::Lite -e 'my $cidr = Net::CIDR::Lite->new; $cidr->add("172.016.0.1/32"); print $cidr->list, "\n"'
172.16.0.1/32

Vs:

$ ping 172.016.0.1
PING 172.016.0.1 (172.14.0.1) 56(84) bytes of data.

Net::CIDR has a Net::CIDR::validate() function, which the documentation says should always be called first; it correctly flags such cases. But Net::CIDR::Lite has no such validator.
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-05-11 22:13:15 UTC 
*** Bug 779163 has been marked as a duplicate of this bug. ***
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-05-11 23:16:39 UTC 
*** Bug 779373 has been marked as a duplicate of this bug. ***
Comment 3 Larry the Git Cow gentoo-dev 2021-05-13 14:39:27 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a86b572696457f90b11af9a476f384f155341782

commit a86b572696457f90b11af9a476f384f155341782
Author:     Andreas K. Hüttel <dilfridge@gentoo.org>
AuthorDate: 2021-05-13 14:39:11 +0000
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: 2021-05-13 14:39:11 +0000

    dev-perl/Net-CIDR-Lite: Version bump 0.22
    
    Bug: https://bugs.gentoo.org/779172
    Package-Manager: Portage-3.0.18, Repoman-3.0.2
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 dev-perl/Net-CIDR-Lite/Manifest                    |  1 +
 .../Net-CIDR-Lite/Net-CIDR-Lite-0.220.0.ebuild     | 23 ++++++++++++++++++++++
 2 files changed, 24 insertions(+)
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-07-16 23:22:19 UTC 
Please cleanup.
Comment 5 NATTkA bot gentoo-dev 2021-07-29 17:23:24 UTC Comment hidden (obsolete)
Comment 6 NATTkA bot gentoo-dev 2021-07-29 17:31:47 UTC Comment hidden (obsolete)
Comment 7 NATTkA bot gentoo-dev 2021-07-29 17:39:41 UTC Comment hidden (obsolete)
Comment 8 NATTkA bot gentoo-dev 2021-07-29 17:47:52 UTC Comment hidden (obsolete)
Comment 9 NATTkA bot gentoo-dev 2021-07-29 18:03:49 UTC Comment hidden (obsolete)
Comment 10 NATTkA bot gentoo-dev 2021-07-29 18:12:07 UTC 
Package list is empty or all packages have requested keywords.
Comment 11 Larry the Git Cow gentoo-dev 2021-07-31 18:02:46 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=069c0f2aafbe6113c3edea6e8a03026799def386

commit 069c0f2aafbe6113c3edea6e8a03026799def386
Author:     Andreas K. Hüttel <dilfridge@gentoo.org>
AuthorDate: 2021-07-31 18:02:23 +0000
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: 2021-07-31 18:02:35 +0000

    dev-perl/Net-CIDR-Lite: Remove old
    
    Bug: https://bugs.gentoo.org/779172
    Package-Manager: Portage-3.0.20, Repoman-3.0.3
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 dev-perl/Net-CIDR-Lite/Manifest                    |  1 -
 .../Net-CIDR-Lite/Net-CIDR-Lite-0.210.0-r1.ebuild  | 22 ----------------------
 2 files changed, 23 deletions(-)