CVE-2023-42282: SSRF

Q: What is the severity of CVE-2023-42282?

CVE-2023-42282 is classified as a high-severity vulnerability due to its potential to execute arbitrary code and access sensitive information.

Q: How do I fix CVE-2023-42282?

To mitigate CVE-2023-42282, upgrade to node-ip version 1.1.9 or higher, or 2.0.1 for upstream packages.

Q: Which software packages are affected by CVE-2023-42282?

CVE-2023-42282 affects the NPM IP package versions 1.1.8 and below, as well as various versions of node-ip on Debian and Ubuntu systems.

Q: What specific function in the NPM IP Package is vulnerable in CVE-2023-42282?

The isPublic() function in the NPM IP Package is the specific point of vulnerability in CVE-2023-42282.

Q: Are there any notable products impacted by CVE-2023-42282?

Yes, IBM Cognos Analytics versions up to 12.0.3 and 11.2.4 FP3 are impacted by CVE-2023-42282.

Published Feb 8, 2024

Updated

An issue in NPM IP Package v.1.1.8 and before allows an attacker to execute arbitrary code and obtain sensitive information via the isPublic() function. https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html https://github.com/indutny/node-ip

Affected Software

14 affected componentsFixes available

debian/node-ip<=1.1.5-3, <=1.1.5-5, <=2.0.0+~1.1.0-1

ubuntu/node-ip<1.1.5-1ubuntu0.1~

1.1.5-1ubuntu0.1~

ubuntu/node-ip<1.1.5-5ubuntu0.1~

1.1.5-5ubuntu0.1~

ubuntu/node-ip<1.1.5+~1.1.0-1ubuntu0.1~

1.1.5+~1.1.0-1ubuntu0.1~

ubuntu/node-ip<2.0.0+~1.1.0-1ubuntu0.1

2.0.0+~1.1.0-1ubuntu0.1

ubuntu/node-ip<1.1.9, <2.0.1

1.1.92.0.1

npm/ip<1.1.9

1.1.9

npm/ip=2.0.0

2.0.1

Fedorindutny Ip Node.js<=1.1.8

Fedorindutny Ip Node.js=2.0.0

Fedorindutny Ip Node.js<1.1.9

redhat/nodejs-ip<1.1.9

1.1.9

redhat/nodejs-ip<2.0.1

2.0.1

IBM Edge Application Manager<=4.5

Remediation

Patch Available

https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894

Event History

Feb 8, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Advisory Published

via GitHub·06:30 PM

Feb 20, 2024

Data Sourced

via Red Hat·06:38 PM

DescriptionSeverityAffected Software

Mar 30, 2024

Data Sourced

via Launchpad·05:59 PM

Description

Jun 30, 2024

News Published

via BleepingComputer·02:31 PM

News Published

via BleepingComputer·02:32 PM

Aug 13, 2024

News Published

via BleepingComputer·09:43 PM

Aug 20, 2025

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-42282?

CVE-2023-42282 is classified as a high-severity vulnerability due to its potential to execute arbitrary code and access sensitive information.

How do I fix CVE-2023-42282?

To mitigate CVE-2023-42282, upgrade to node-ip version 1.1.9 or higher, or 2.0.1 for upstream packages.

Which software packages are affected by CVE-2023-42282?

CVE-2023-42282 affects the NPM IP package versions 1.1.8 and below, as well as various versions of node-ip on Debian and Ubuntu systems.

What specific function in the NPM IP Package is vulnerable in CVE-2023-42282?

The isPublic() function in the NPM IP Package is the specific point of vulnerability in CVE-2023-42282.

Are there any notable products impacted by CVE-2023-42282?

Yes, IBM Cognos Analytics versions up to 12.0.3 and 11.2.4 FP3 are impacted by CVE-2023-42282.

CVE-2023-42282: SSRF

Affected Software

Remediation

Patch Available

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2023-42282?

How do I fix CVE-2023-42282?

Which software packages are affected by CVE-2023-42282?

What specific function in the NPM IP Package is vulnerable in CVE-2023-42282?

Are there any notable products impacted by CVE-2023-42282?

Company

Resources

Contact