Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:20773-1

Опубликовано: 19 мая 2026
Источник: suse-cvrf

Описание

Security update for perl-Net-CIDR

This update for perl-Net-CIDR fixes the following issues:

Changes in perl-Net-CIDR:

  • updated to 0.270.0 (0.27) 0.27 Sam Varshavchik cidrvalidate() bug fix.

  • updated to 0.260.0 (0.26) 0.26 Sam Varshavchik cidrvalidate() should accept IPv6 addresses with one uncompressed 0.

  • updated to 0.250.0 (0.25) 0.25 Sam Varshavchik Fix warning with Perl 5.40 0.24.1 No changes, re-pushed due to a release problem. 0.24 2025-03-09 brian d foy

    • Strip leading zeros from octets from addr2cidr bsc#1259024 CVE-2021-4456

  • updated to 0.230.0 (0.23) 0.23 2025-03-09 brian d foy

    • Allow unabbreviated IPv6 addresses. 0.22 2025-03-09 Sam Varshavchik
    • Improve several error messages. 2025-03-09 brian d foy
    • Allow unabbreviated IPv6 addresses.

Список пакетов

openSUSE Leap 16.0
perl-Net-CIDR-0.270.0-bp160.1.1

Ссылки

Описание

Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses. The documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.

Затронутые продукты
openSUSE Leap 16.0:perl-Net-CIDR-0.270.0-bp160.1.1
Ссылки