CVE-2021-29662: 
Linux Debian vulnerability analysis and mitigation

The Data::Validate::IP Perl module through version 0.29 contains a vulnerability related to improper input validation of IP addresses. The module does not properly consider extraneous zero characters at the beginning of an IP address string, which allows attackers to bypass access control mechanisms based on IP address validation (CVE Mitre, NVD). The vulnerability was discovered and disclosed on March 29, 2021, with CVE-2021-29662 being assigned on March 31, 2021.

The vulnerability stems from the module's handling of octal literals in IP addresses. When an IP address contains leading zeros (e.g., '010.0.0.1'), the operating system interprets these numbers as octal values, meaning '010' is actually interpreted as '8' in decimal. However, the Data::Validate::IP module incorrectly processes these addresses, leading to validation inconsistencies. The vulnerability has a CVSS score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (Sick Codes, NetApp Advisory).

The vulnerability can lead to Server-Side Request Forgery (SSRF), Remote File Inclusion (RFI), and Local File Inclusion (LFI) attacks. For example, an attacker could submit an IP address like '012.0.0.1' (which should be interpreted as '10.0.0.1' and identified as private) but the module incorrectly validates it, potentially allowing access to restricted resources (Sick Codes).

The vulnerability was patched in version 0.30 of the Data::Validate::IP module. Users should upgrade to this version or later to address the vulnerability. The documentation was also updated to explicitly recommend always calling isipv4() in addition to other validation methods like isprivate_ipv4() (Perl Blog).

Multiple security researchers collaborated on identifying and reporting this vulnerability, including Dave Rolsky, Victor Viale, Sick Codes, Kelly Kaoudis, John Jackson, Nick Sahler, and Olivier Poitrey. The vendor responded quickly by releasing a patch and updating documentation to clarify proper usage of the module (Sick Codes).