CPANSA-Net-IP-LPM-2025-40910: Net-IP-LPM vulnerability
Publisher | giterlizzi | Document category | csaf_security_advisory |
---|---|---|---|
Initial release date | 2025-06-27T00:00:00 | Engine | CSAF Perl Toolkit 0.25 |
Current release date | 2025-06-27T00:00:00 | Build Date | |
Current version | 1 | Status | final |
CVSS v3.1 Base Score | 6.5 | Severity | |
Original language | Language | en | |
Also referred to |
Vulnerability Description
Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses. Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation.
Vulnerabilities
CVE-2025-40910
Vulnerability DescriptionNet::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses.
Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation.
Weakness | CWE-1287 : Improper Validation of Specified Type of Input |
---|
Product status
Known affected
Product | Score | ||||||||
---|---|---|---|---|---|---|---|---|---|
Net-IP-LPM greater than or equal 1.10 |
|
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-Net-IP-LPM-2025-40910 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2025/cpansa-net-ip-lpm-2025-40910.json - https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ external
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ - https://metacpan.org/release/TPODER/Net-IP-LPM-1.10/diff/TPODER/Net-IP-LPM-1.09/lib/Net/IP/LPM.pm external
https://metacpan.org/release/TPODER/Net-IP-LPM-1.10/diff/TPODER/Net-IP-LPM-1.09/lib/Net/IP/LPM.pm - https://security.metacpan.org/patches/N/Net-IP-LPM/1.10/CVE-2025-40910-r1.patch external
https://security.metacpan.org/patches/N/Net-IP-LPM/1.10/CVE-2025-40910-r1.patch - CVE-2025-40910 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2025-40910
Revision history
Version | Date of the revision | Summary of the revision |
---|---|---|
1 | Fri Jun 27 00:00:00 2025 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/