CVE-2021-47154: 
Linux Debian vulnerability analysis and mitigation

The Net::CIDR::Lite Perl module before version 0.22 contains a security vulnerability (CVE-2021-47154) where extraneous zero characters at the beginning of an IP address string are not properly handled. This vulnerability was discovered in March 2024 and affects systems using the Net::CIDR::Lite module for IP address handling and access control (NVD, RedHat).

The vulnerability stems from the module's incorrect handling of IP addresses with leading zeros in octets. For example, an address like '010.0.0.1' should be interpreted as '8.0.0.1' (where 010 is octal), but the vulnerable versions of the module incorrectly treated it as '10.0.0.1'. The issue was fixed in version 0.22 by preventing the use of leading zeros in IPv4 octets (GitHub).

This vulnerability could allow attackers to bypass access control mechanisms that are based on IP addresses. For example, an attacker could potentially trick the system into treating a public IP address (8.0.0.1) as if it were part of a private subnet (10.0.0.0/8), potentially bypassing network security controls (Blog).

The vulnerability can be exploited by manipulating IP address strings to include leading zeros. This could be particularly impactful in scenarios where the module is used for IP-based access control or network security filtering. The CVSS v3.1 base score is 6.3 (Medium), indicating moderate severity with network vector and low attack complexity (RedHat).

The recommended mitigation is to upgrade to Net::CIDR::Lite version 0.22 or later, which prevents the use of leading zeros in IPv4 octets. For systems that cannot be immediately upgraded, it is recommended to implement additional validation of IP addresses to ensure they do not contain leading zeros (Debian).