CVE-2021-29662: Incorrect Type Conversion or Cast (CWE-704)
value: The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
CWE description: The product does not correctly convert an object, resource, or structure from one type to a different type.
CVSS v3 base score: 7.5
Published: 2021-03-31T18:15Z
Repository: https://github.com/houseabsolute/Data-Validate-IP
Language: Other
Files changed: Changes, lib/Data/Validate/IP.pm
Commit date: 2021-03-29 16:49:05 -0500
Commit message: Update security note in docs to include mention of is_ip() and friends

Diff: diff --git a/Changes b/Changes
index c0d4980..1ac743b 100644
--- a/Changes
+++ b/Changes
@@ -1,7 +1,11 @@
 {{$NEXT}}
 
+- Added some more details to the security docs to include mentions of the
+  is_*_ip() functions too.
+
+
 0.29  2021-03-29
 
 - Fixed a typo in the POD.
 
 
diff --git a/lib/Data/Validate/IP.pm b/lib/Data/Validate/IP.pm
index fc0442a..e42d322 100644
--- a/lib/Data/Validate/IP.pm
+++ b/lib/Data/Validate/IP.pm
@@ -640,28 +640,30 @@ and untaint their input. This includes both basic validation (C<is_ipv4()> and
 C<is_ipv6()>) and special cases like checking whether an address belongs to a
 specific network or whether an address is public or private (reserved).
 
 =head1 USAGE AND SECURITY RECOMMENDATIONS
 
-It's important to understand that if C<is_ipv4($ip)> or C<is_ipv6($ip)> return
-false, then all other validation functions for that IP address family will
-I<also> return false. So for example, if C<is_ipv4($ip)> is false, so are both
-C<is_private_ipv4($ip)> I<and> C<is_public_ipv4($ip)>.
+It's important to understand that if C<is_ipv4($ip)>, C<is_ipv6($ip)>, or
+C<is_ip($ip)> return false, then all other validation functions for that IP
+address family will I<also> return false. So for example, if C<is_ipv4($ip)>
+returns false, then C<is_private_ipv4($ip)> I<and> C<is_public_ipv4($ip)> will
+both also return false.
 
 This means that simply calling C<is_private_ipv4($ip)> by itself is not
 sufficient if you are dealing with untrusted input. You should always check
-C<is_ipv4($ip)> as well.
+C<is_ipv4($ip)> as well. This applies as well when using IPv6 functions or
+generic functions like C<is_private_ip($ip)>.
 
 There are security implications to this around certain oddly formed
 addresses. Notably, an address like "010.0.0.1" is technically valid, but the
 operating system will treat "010" as an octal number. That means that
 "010.0.0.1" is equivalent to "8.0.0.1", I<not> "10.0.0.1".
 
-However, this module's C<is_ipv4($ip)> function will return false for
-addresses like "010.0.0.1" which have octal components. And of course that
-means that it also returns false for C<is_private_ipv4($ip)> I<and>
-C<is_public_ipv4($ip)>.
+However, this module's C<is_ipv4($ip)> and C<is_ip($ip)> functions will return
+false for addresses like "010.0.0.1" which have octal components. And of
+course that means that it also returns false for C<is_private_ipv4($ip)>
+I<and> C<is_public_ipv4($ip)>.
 
 =head1 FUNCTIONS
 
 All of the functions below are exported by default.
 

Vulnerable code: It's important to understand that if C<is_ipv4($ip)> or C<is_ipv6($ip)> return
false, then all other validation functions for that IP address family will
I<also> return false. So for example, if C<is_ipv4($ip)> is false, so are both
C<is_private_ipv4($ip)> I<and> C<is_public_ipv4($ip)>.
C<is_ipv4($ip)> as well.
However, this module's C<is_ipv4($ip)> function will return false for
addresses like "010.0.0.1" which have octal components. And of course that
means that it also returns false for C<is_private_ipv4($ip)> I<and>
C<is_public_ipv4($ip)>.
Fixed code: - Added some more details to the security docs to include mentions of the
  is_*_ip() functions too.


It's important to understand that if C<is_ipv4($ip)>, C<is_ipv6($ip)>, or
C<is_ip($ip)> return false, then all other validation functions for that IP
address family will I<also> return false. So for example, if C<is_ipv4($ip)>
returns false, then C<is_private_ipv4($ip)> I<and> C<is_public_ipv4($ip)> will
both also return false.
C<is_ipv4($ip)> as well. This applies as well when using IPv6 functions or
generic functions like C<is_private_ip($ip)>.
However, this module's C<is_ipv4($ip)> and C<is_ip($ip)> functions will return
false for addresses like "010.0.0.1" which have octal components. And of
course that means that it also returns false for C<is_private_ipv4($ip)>
I<and> C<is_public_ipv4($ip)>.