CVE-2021-47154

Name	CVE-2021-47154
Description	The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3770-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libnet-cidr-lite-perl (PTS)	bullseye	0.22-1	fixed
	sid, trixie, bookworm	0.22-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libnet-cidr-lite-perl	source	buster	0.21-2+debu10u1		DLA-3770-1
libnet-cidr-lite-perl	source	(unstable)	0.22-1

Notes

https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/#net-cidr-litehttpsmetacpanorgreleasenet-cidr-lite
https://github.com/stigtsp/Net-CIDR-Lite/commit/23b6ff0590dc279521863a502e890ef19a5a76fc (0.22)