Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses. The documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8110-1 advisory.

    Dave Rolsky discovered that Net-CIDR did not properly sanitize IP addresses. An attacker could possibly     use this to bypass IP-based restrictions.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-baf8782c7a advisory.

    Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have     unspecified impact.
    The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be     parsed as octal numbers by subsequent users.

    Current versions of the module strip leading zeros from octets.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have     unspecified impact. The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string,     which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to     leverage this to bypass access controls based on IP addresses. The documentation advises validating     untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not     enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and     without validation, incorrectly assuming that this is safe. (CVE-2021-4456)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
303194	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Net-CIDR vulnerability (USN-8110-1)	Nessus	Ubuntu Local Security Checks	medium
301671	Fedora 42 : perl-Net-CIDR (2026-baf8782c7a)	Nessus	Fedora Local Security Checks	medium
300179	Linux Distros Unpatched Vulnerability : CVE-2021-4456	Nessus	Misc.	medium

Detections

Analytics

CVE-2021-4456

medium

Tenable Plugins

medium

medium

medium