CVE-2021-47154

Publication date 18 March 2024

Last updated 30 May 2025

Ubuntu priority

Cvss 3 Severity Score

The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libnet-cidr-lite-perl	25.04 plucky	Not affected
	24.10 oracular	Not affected
	24.04 LTS noble	Not affected
	23.10 mantic	Not affected
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Fixed 0.21-2ubuntu0.1
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libnet-cidr-lite-perl	Upstream: 23b6ff0

Severity score breakdown

Parameter	Value
Base score	6.3 · Medium
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	Low
Integrity impact	Low
Availability impact	Low
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References

Related Ubuntu Security Notices (USN)

USN-6712-1
Net::CIDR::Lite vulnerability
25 March 2024