Am Wed, May 29, 2024 at 10:26:24AM +0400 schrieb Yadd:
> On 5/29/24 00:40, Moritz Mühlenhoff wrote:
> > Source: node-ip
> > X-Debbugs-CC: t...@security.debian.org
> > Severity: important
> > Tags: security
> >
> > Hi,
> >
> > The following vulnerability was published for node-ip.
> >
> > CVE-2024-29415[0]:
> > | The ip package through 2.0.1 for Node.js might allow SSRF because
> > | some IP addresses (such as 127.1, 01200034567, 012.1.2.3,
> > | 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as
> > | globally routable via isPublic. NOTE: this issue exists because of
> > | an incomplete fix for CVE-2023-42282.
> >
> > https://github.com/indutny/node-ip/issues/150
> > https://github.com/indutny/node-ip/pull/144
> > https://github.com/indutny/node-ip/pull/143
> >
> >
> > If you fix the vulnerability please also make sure to include the
> > CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> >
> > For further information see:
> >
> > [0] https://security-tracker.debian.org/tracker/CVE-2024-29415
> > https://www.cve.org/CVERecord?id=CVE-2024-29415
> >
> > Please adjust the affected versions in the BTS as needed.
>
> The proposed patch changes node-ip behavior and needs recent nodejs. I just
> pushed it to experimental to have more test.
Given it was in experimental for almost a year, do you believe it's
ready to land in sid, so that it can make it to trixie?
Cheers,
Moritz
