CVE-2021-29662 (published 2021-03-31T18:15Z)

The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-704
cwe_name: Incorrect Type Conversion or Cast
description: The product does not correctly convert an object, resource, or structure from one type to a different type.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/houseabsolute/Data-Validate-IP
commit_details: repo_url: https://github.com/houseabsolute/Data-Validate-IP
author: Dave Rolsky
author_date: 2021-03-29 16:49:05-05:00
msg: Update security note in docs to include mention of is_ip() and friends
repository: repo_url: https://github.com/houseabsolute/Data-Validate-IP
repo_name: houseabsolute/Data-Validate-IP
description: IPv4 and IPv6 validation methods
repo_language: Perl
owner: houseabsolute
file_changes: filename: Changes
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,9 @@
 {{$NEXT}}
 
+- Added some more details to the security docs to include mentions of the
+  is_*_ip() functions too.
+
+
 0.29  2021-03-29
 
 - Fixed a typo in the POD.

programming_language: Markdown
filename: IP.pm
change_type: ModificationType.MODIFY
diff: @@ -642,24 +642,26 @@ specific network or whether an address is public or private (reserved).
 
 =head1 USAGE AND SECURITY RECOMMENDATIONS
 
-It's important to understand that if C<is_ipv4($ip)> or C<is_ipv6($ip)> return
-false, then all other validation functions for that IP address family will
-I<also> return false. So for example, if C<is_ipv4($ip)> is false, so are both
-C<is_private_ipv4($ip)> I<and> C<is_public_ipv4($ip)>.
+It's important to understand that if C<is_ipv4($ip)>, C<is_ipv6($ip)>, or
+C<is_ip($ip)> return false, then all other validation functions for that IP
+address family will I<also> return false. So for example, if C<is_ipv4($ip)>
+returns false, then C<is_private_ipv4($ip)> I<and> C<is_public_ipv4($ip)> will
+both also return false.
 
 This means that simply calling C<is_private_ipv4($ip)> by itself is not
 sufficient if you are dealing with untrusted input. You should always check
-C<is_ipv4($ip)> as well.
+C<is_ipv4($ip)> as well. This applies as well when using IPv6 functions or
+generic functions like C<is_private_ip($ip)>.
 
 There are security implications to this around certain oddly formed
 addresses. Notably, an address like "010.0.0.1" is technically valid, but the
 operating system will treat "010" as an octal number. That means that
 "010.0.0.1" is equivalent to "8.0.0.1", I<not> "10.0.0.1".
 
-However, this module's C<is_ipv4($ip)> function will return false for
-addresses like "010.0.0.1" which have octal components. And of course that
-means that it also returns false for C<is_private_ipv4($ip)> I<and>
-C<is_public_ipv4($ip)>.
+However, this module's C<is_ipv4($ip)> and C<is_ip($ip)> functions will return
+false for addresses like "010.0.0.1" which have octal components. And of
+course that means that it also returns false for C<is_private_ipv4($ip)>
+I<and> C<is_public_ipv4($ip)>.
 
 =head1 FUNCTIONS
 

programming_language: Perl