CVE-2021-33318 (published 2022-05-16T16:15Z)

An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and below (IpMatcher) and 4.1.3 and below (WatsonWebserver) due to insufficient validation of input IP addresses and netmasks against the internal Matcher list of IP addresses and subnets.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-704
cwe_name: Incorrect Type Conversion or Cast
description: The product does not correctly convert an object, resource, or structure from one type to a different type.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/jchristn/IpMatcher
commit_details: repo_url: https://github.com/jchristn/IpMatcher
author: Joel Christner
author_date: 2021-08-18 13:28:16-07:00
msg: NuGet v1.0.4.2, fix for SICK-2021-060
repository: repo_url: https://github.com/jchristn/IpMatcher
repo_name: jchristn/IpMatcher
description: C# library for maintaining a match list of IP addresses and networks and comparing inputs to see if a match exists.
repo_language: C#
owner: jchristn
file_changes: filename: IpMatcher.csproj
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
   <PropertyGroup>
     <TargetFrameworks>netstandard2.0;netstandard2.1;netcoreapp3.1;net452;net5.0</TargetFrameworks>
     <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
-    <Version>1.0.4.1</Version>
+    <Version>1.0.4.2</Version>
     <Authors>Joel Christner</Authors>
     <Description>Library for maintaining a match list of IP addresses and networks and comparing inputs to see if a match exists.</Description>
     <Copyright>(c)2021 Joel Christner</Copyright>
@@ -11,13 +11,17 @@
     <RepositoryUrl>https://github.com/jchristn/ipmatcher</RepositoryUrl>
     <RepositoryType>Github</RepositoryType>
     <PackageLicenseUrl></PackageLicenseUrl>
-    <PackageReleaseNotes>XML documentation</PackageReleaseNotes>
+    <PackageReleaseNotes>Fix for SICK-2021-060</PackageReleaseNotes>
     <PackageTags>ip address match netmask network mask subnet cidr</PackageTags>
     <PackageLicenseFile>LICENSE.md</PackageLicenseFile>
   </PropertyGroup>
 
   <PropertyGroup Condition="'$(Configuration)|$(TargetFramework)|$(Platform)'=='Release|netstandard2.0|AnyCPU'">
-    <DocumentationFile>C:\Code\Misc\IpMatcher\IpMatcher\IpMatcher.xml</DocumentationFile>
+    <DocumentationFile>IpMatcher.xml</DocumentationFile>
+  </PropertyGroup>
+
+  <PropertyGroup Condition="'$(Configuration)|$(TargetFramework)|$(Platform)'=='Debug|netstandard2.0|AnyCPU'">
+    <DocumentationFile>IpMatcher.xml</DocumentationFile>
   </PropertyGroup>
 
   <ItemGroup>

programming_language: PowerShell
filename: IpMatcher.xml
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,11 @@
             IP address matcher.
             </summary>
         </member>
+        <member name="F:IpMatcher.Matcher.Logger">
+            <summary>
+            Method to invoke to send log messages.
+            </summary>
+        </member>
         <member name="M:IpMatcher.Matcher.#ctor">
             <summary>
             Instantiate the IP address matcher.
@@ -42,5 +47,11 @@
             <param name="ip">The IP address, i.e. 192.168.1.34.</param>
             <returns>True if a match is found.</returns>
         </member>
+        <member name="M:IpMatcher.Matcher.All">
+            <summary>
+            Retrieve all stored addresses.
+            </summary>
+            <returns></returns>
+        </member>
     </members>
 </doc>

programming_language: C#
filename: Matcher.cs
change_type: ModificationType.MODIFY
diff: @@ -59,6 +59,9 @@ namespace IpMatcher
             if (String.IsNullOrEmpty(ip)) throw new ArgumentNullException(nameof(ip));
             if (String.IsNullOrEmpty(netmask)) throw new ArgumentNullException(nameof(netmask));
 
+            ip = IPAddress.Parse(ip).ToString();
+            netmask = IPAddress.Parse(netmask).ToString();
+
             string baseAddress = GetBaseIpAddress(ip, netmask);
             IPAddress parsed = IPAddress.Parse(baseAddress);
             if (Exists(baseAddress, netmask)) return;
@@ -83,6 +86,9 @@ namespace IpMatcher
             if (String.IsNullOrEmpty(ip)) throw new ArgumentNullException(nameof(ip));
             if (String.IsNullOrEmpty(netmask)) throw new ArgumentNullException(nameof(netmask));
 
+            ip = IPAddress.Parse(ip).ToString();
+            netmask = IPAddress.Parse(netmask).ToString();
+
             lock (_CacheLock)
             {
                 if (_Cache.ContainsKey(ip))
@@ -116,6 +122,8 @@ namespace IpMatcher
         {
             if (String.IsNullOrEmpty(ip)) throw new ArgumentNullException(nameof(ip));
 
+            ip = IPAddress.Parse(ip).ToString();
+
             lock (_CacheLock)
             {
                 _Cache = _Cache.Where(d => !d.Key.Equals(ip)).ToDictionary(d => d.Key, d => d.Value);
@@ -140,6 +148,8 @@ namespace IpMatcher
         {
             if (String.IsNullOrEmpty(ip)) throw new ArgumentNullException(nameof(ip));
 
+            ip = IPAddress.Parse(ip).ToString();
+
             IPAddress parsed = IPAddress.Parse(ip);
 
             lock (_CacheLock)

programming_language: C#