REDHAT-BUG-2284554: SSRF
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
References:
https://github.com/indutny/node-ip/issues/150 https://github.com/indutny/node-ip/pull/143 https://github.com/indutny/node-ip/pull/144
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2284554?
The severity of REDHAT-BUG-2284554 is considered critical due to its potential to allow SSRF attacks.
How do I fix REDHAT-BUG-2284554?
To fix REDHAT-BUG-2284554, you should update the 'node-ip' package to version 2.0.2 or later.
What does REDHAT-BUG-2284554 vulnerability affect?
The REDHAT-BUG-2284554 vulnerability affects the 'node-ip' package used in Node.js applications.
Can REDHAT-BUG-2284554 allow remote code execution?
REDHAT-BUG-2284554 does not directly allow remote code execution but could facilitate SSRF, leading to other security risks.
Is a workaround available for REDHAT-BUG-2284554?
Currently, there is no specific workaround for REDHAT-BUG-2284554 aside from updating the vulnerable package.