CVE-2021-47155

Name	CVE-2021-47155
Description	The Net::IPV4Addr module 0.10 for Perl does not properly consider extraneous zero characters in an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1072178

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libnetwork-ipv4addr-perl (PTS)	bullseye	0.10.ds-3.1	vulnerable
	bookworm, sid, trixie	0.10.ds-4	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libnetwork-ipv4addr-perl	source	(unstable)	(unfixed)			1072178

Notes

[bookworm] - libnetwork-ipv4addr-perl <postponed> (Minor issue, revisit when fixed upstream)
[bullseye] - libnetwork-ipv4addr-perl <no-dsa> (Minor issue)
[buster] - libnetwork-ipv4addr-perl <postponed> (Minor issue, revisit when fix is available)
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/#net-ipv4addrhttpsmetacpanorgreleasenet-ipv4addr