CVE-2021-47155

What it actually does

The Net::IPV4Addr 0.10 Perl module fails to normalize IP address strings containing extraneous leading zeros, allowing crafted addresses to bypass string-based IP access control checks.

Why it matters to the business

Attackers can gain unauthorized network access to systems that rely on this module for IP filtering, potentially exposing sensitive data or services.

How an attack unfolds

An attacker identifies a service or firewall rule that uses Net::IPV4Addr for allow-list validation, then submits an IP address with padded zeros (e.g., 010.000.000.001) that the module treats as inequivalent to the canonical form, evading the intended restriction.

How to fix it

Upgrade gcc-toolset-10-valgrind to 1:3.16.0-6.el8_4 and gcc-toolset-10-valgrind-devel to 1:3.16.0-6.el8_4 (or later) on AlmaLinux 8 systems; replace or patch any direct use of Net::IPV4Addr 0.10 with a corrected implementation that properly normalizes IP strings.

How to confirm the fix worked

Verify package versions match the fixed releases, test that IP strings with leading zeros are now correctly normalized or rejected by access-control logic, and review any custom Perl code that parses IP addresses for equivalent normalization behavior.

Typical attack path

1. Identify target service or configuration using Net::IPV4Addr for IP-based authorization
2. Craft an IP address string containing extraneous leading zeros that matches an allowed entry after canonicalization failure
3. Submit the malformed address via network request, authentication, or configuration interface
4. Bypass the access control check and reach the protected resource

How to detect it

Review application and web-server logs for IP address strings containing leading zeros in fields used for authorization decisions; search Perl process command lines or loaded modules for references to Net::IPV4Addr version 0.10.

What your security team should do

• Apply the listed AlmaLinux package updates immediately on all affected systems
• Audit configurations and code that perform IP-based access decisions for reliance on Net::IPV4Addr
• Implement defense-in-depth controls such as additional allow-list validation layers or network segmentation
• Monitor for any remaining instances of the vulnerable module across the environment