Описание
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| node-ip | fixed | 2.0.1+~1.1.3-2 | experimental | package |
| node-ip | fixed | 2.0.1+~1.1.3-3 | package | |
| node-ip | no-dsa | bookworm | package | |
| node-ip | no-dsa | bullseye | package | |
| node-ip | postponed | buster | package |
Примечания
https://github.com/indutny/node-ip/issues/150
https://github.com/indutny/node-ip/pull/144
https://github.com/indutny/node-ip/pull/143
When fixing the issue make sure to not open CVE-2025-59436 and CVE-2025-59437
(existing for an incomplete fixes of CVE-2024-29415).
EPSS
Связанные уязвимости
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
Уязвимость функции isPublic() утилиты node-ip программной платформы Node.js, позволяющая нарушителю реализовать SSRF-атаку
EPSS