{"id":"CVE-2021-29424","aliases":["ALPINE-CVE-2021-29424","DEBIAN-CVE-2021-29424","EUVD-2021-16056","GHSA-p75p-x3j9-7vj3","MGASA-2021-0375","UBUNTU-CVE-2021-29424","openSUSE-SU-2023:0215-1","openSUSE-SU-2023:0217-1"],"status":"published","title":"The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero...","description":"The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01797,"percentile":0.78628,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-704","CWE-863"],"published":"2021-03-29T23:02:41Z","modified":"2026-11-03T06:32:38Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"perl-net-netmask","fixed_in":["2.0000-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libnet-netmask-perl","fixed_in":["1.9104-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libnet-netmask-perl","fixed_in":["1.9104-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libnet-netmask-perl","fixed_in":["1.9104-2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"perl-Net-Netmask","fixed_in":["2.0.100-1.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"perl-Net-Netmask","fixed_in":["1.9022-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"perl-Net-Netmask","fixed_in":["1.9022-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"perl-Net-Netmask","fixed_in":["1.9022-bp155.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"perl-Net-Netmask","fixed_in":["1.9022-bp155.3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl-net-netmask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0000-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libnet-netmask-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9104-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libnet-netmask-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9104-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libnet-netmask-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9104-2"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"perl-Net-Netmask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.100-1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libnet-netmask-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9021-1","1.9022-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libnetwork-ipv4addr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.ds-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libnet-netmask-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9022-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libnetwork-ipv4addr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.ds-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libnet-netmask-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9104-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libnetwork-ipv4addr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.ds-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnetwork-ipv4addr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.ds-3.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnetwork-ipv4addr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.ds-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libnetwork-ipv4addr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.ds-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libnetwork-ipv4addr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.ds-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libnetwork-ipv4addr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.ds-4"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"perl-Net-Netmask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9022-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"perl-Net-Netmask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9022-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"perl-Net-Netmask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9022-bp155.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"perl-Net-Netmask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9022-bp155.3.3.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"net\\","product":"\\"}],"references":[{"url":"https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://metacpan.org/changes/distribution/Net-Netmask#L11-22","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBJVLXJSWN6DKSF5ADUEERI6M23R3GGP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JF4CYIZELC3NISB3RMV4OCI4GYBC557B/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7JIPQAY5OZ5D3DA7INQILU7SGHTHMWB/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210604-0007/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29424"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBJVLXJSWN6DKSF5ADUEERI6M23R3GGP/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JF4CYIZELC3NISB3RMV4OCI4GYBC557B/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y7JIPQAY5OZ5D3DA7INQILU7SGHTHMWB/"},{"url":"https://github.com/advisories/GHSA-p75p-x3j9-7vj3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-29424","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-29424","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0375.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29023","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/CBJVLXJSWN6DKSF5ADUEERI6M23R3GGP/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-29424","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-29424","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7UYESPZ25JO4DP7GV5KTIH3W7NKCQ62I/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1184425","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29424","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6ZJZ52ER45AJ5J3AJXDBMK5W5ESAW6G5/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-29424","description":"The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","status":"published","published":"2021-03-29T23:02:41Z","modified":"2024-08-03T22:02:51.897Z","updated_at":"2026-11-02T14:33:06.32268Z"}],"euvd":[{"id":"EUVD-2021-16056","description":"The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","status":"published","published":"2021-03-29T23:02:41Z","modified":"2024-08-03T22:02:51Z","updated_at":"2026-11-03T03:24:45.000012Z"}],"ghsa":[{"id":"GHSA-p75p-x3j9-7vj3","title":"The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero...","description":"The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","status":"published","published":"2022-05-24T17:46:40Z","modified":"2023-08-17T05:02:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:54:45.82233Z"}],"nvd":[{"id":"CVE-2021-29424","description":"The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","status":"published","published":"2021-04-06T16:15:16.567Z","modified":"2026-06-17T03:47:36.42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T14:06:51.610648Z"}],"osv":[{"id":"ALPINE-CVE-2021-29424","description":"The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","status":"published","published":"2021-04-06T16:15:16.567Z","modified":"2026-11-03T06:32:38.924431274Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2021-29424","description":"The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","status":"published","published":"2021-04-06T16:15:16.567Z","modified":"2026-04-16T04:36:22.200871143Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-29424","description":"The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","status":"published","published":"2021-04-06T16:15:16.567Z","modified":"2026-10-23T18:02:30.260660387Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"UBUNTU-CVE-2021-29424","description":"The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","status":"published","published":"2021-04-06T16:15:00Z","modified":"2026-10-17T12:57:12.744760475Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"MGASA-2021-0375","title":"Updated perl-Net-Netmask package fixes a security vulnerability","description":"The Net::Netmask module before 2.0000 for Perl does not properly consider\nextraneous zero characters at the beginning of an IP address string, which\n(in some situations) allows attackers to bypass access control that is based\non IP addresses (CVE-2021-29424).\n","status":"published","published":"2021-07-27T20:21:53Z","modified":"2026-04-16T04:43:27.116803877Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2023:0215-1","title":"Security update for perl-Net-Netmask","description":"This update for perl-Net-Netmask fixes the following issues:\n\n* CVE-2021-29424: Leading zeros are no longer allowed for IPv4 octets. This\n  (in some situations) allows attackers to bypass access control\n  that is based on IP addresses.(boo#1184425)\n","status":"published","published":"2023-08-07T04:01:39Z","modified":"2026-02-04T03:32:04.659569Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2023:0217-1","title":"Security update for perl-Net-Netmask","description":"This update for perl-Net-Netmask fixes the following issues:\n\n* CVE-2021-29424: Leading zeros are no longer allowed for IPv4 octets. This\n  (in some situations) allows attackers to bypass access control\n  that is based on IP addresses.  (boo#1184425)\n","status":"published","published":"2023-08-07T12:01:29Z","modified":"2026-02-04T04:11:07.526148Z","updated_at":"2026-11-02T16:58:32.653274Z"}]}}