Описание
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support |
| devel | released | 2.0.0+~1.1.0-1ubuntu1 |
| esm-apps/bionic | released | 1.1.5-1ubuntu0.1~esm1 |
| esm-apps/focal | released | 1.1.5-5ubuntu0.1~esm1 |
| esm-apps/jammy | released | 1.1.5+~1.1.0-1ubuntu0.1~esm1 |
| esm-apps/noble | released | 2.0.0+~1.1.0-1ubuntu1 |
| esm-apps/resolute | released | 2.0.0+~1.1.0-1ubuntu1 |
| focal | ignored | end of standard support, was needed |
| jammy | needed | |
| mantic | released | 2.0.0+~1.1.0-1ubuntu0.1 |
Показывать по
9.8 Critical
CVSS3
Связанные уязвимости
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
The ip package before 1.1.9 for Node.js might allow SSRF because some ...
NPM IP package incorrectly identifies some private IP addresses as public
9.8 Critical
CVSS3