CVE catalog

CVE-2021-29424

libnet-netmask-perl: CVE-2021-29424

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.80% · Oct 25, 2026

The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibnet-netmask-perlsid2.0003-1fixed
Debianlibnet-netmask-perlforky2.0003-1fixed
Debianlibnet-netmask-perltrixie2.0002-2fixed
Debianlibnet-netmask-perlbookworm2.0002-2fixed
Suseperl-Net-Netmaskpackage hub 15 sp51.9022-bp155.3.3.1fixed
Opensuseperl-Net-Netmaskleap 15.51.9022-bp155.3.3.1fixed
Suseperl-Net-Netmaskpackage hub 15 sp41.9022-bp154.2.3.1fixed
Opensuseperl-Net-Netmaskleap 15.41.9022-bp154.2.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibnet-netmask-perlsourcesid1.9104-2not yet assignedNot reported[986135]
Debianlibnet-netmask-perlsourceforky1.9104-2not yet assignedNot reported[986135]
Debianlibnet-netmask-perlsourcetrixie1.9104-2not yet assignedNot reported[986135]
Debianlibnet-netmask-perlsourcebookworm1.9104-2not yet assignedNot reported[986135]
Suseperl-Net-Netmaskrpmpackage hub 15 sp51.9022-bp155.3.3.1Not reportedOPENSUSE-SU-2023:0217-1Not reported
Opensuseperl-Net-Netmaskrpmleap 15.51.9022-bp155.3.3.1Not reportedOPENSUSE-SU-2023:0217-1Not reported
Suseperl-Net-Netmaskrpmpackage hub 15 sp41.9022-bp154.2.3.1Not reportedOPENSUSE-SU-2023:0215-1Not reported
Opensuseperl-Net-Netmaskrpmleap 15.41.9022-bp154.2.3.1Not reportedOPENSUSE-SU-2023:0215-1Not reported

[Debian bug #986135]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libnet-netmask-perl]Fixed
    Details (2)

    • 2.0002-2 · all · bookworm

      Fixed · Fixed: 1.9104-2

      dsa · libnet-netmask-perl · debian · bookworm; dsa · libnet-netmask-perl · debian · 12

    • 2.0002-2 · all · bookworm

      Fixed · Fixed: 1.9104-2

      dsa · libnet-netmask-perl · debian · bookworm; dsa · libnet-netmask-perl · debian · 12

[Debian 13 (Trixie)]

  • [libnet-netmask-perl]Fixed
    Details (2)

    • 2.0002-2 · all · trixie

      Fixed · Fixed: 1.9104-2

      dsa · libnet-netmask-perl · debian · 13

    • 2.0002-2 · all · trixie

      Fixed · Fixed: 1.9104-2

      dsa · libnet-netmask-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]