Summary
Emre Durmaz discovered that NPM IP package incorrectly distinguished
between private and public IP addresses. A remote attacker could
possibly use this issue to perform
Server-Side Request Forgery (SSRF) attacks.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | node-ip | 1.1.5-1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | node-ip | 1.1.5-5ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | node-ip | 1.1.5+~1.1.0-1ubuntu0.1~esm1 |
Vulnerabilities 1
-
Critical 9.8
NPM IP package incorrectly identifies some private IP addresses as public
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
References
-
report
https://ubuntu.com/security/CVE-2023-42282