On 4/22/25 15:39, Moritz Mühlenhoff wrote:
Am Wed, May 29, 2024 at 10:26:24AM +0400 schrieb Yadd:
On 5/29/24 00:40, Moritz Mühlenhoff wrote:
Source: node-ip
X-Debbugs-CC: t...@security.debian.org
Severity: important
Tags: security
Hi,
The following vulnerability was published for node-ip.
CVE-2024-29415[0]:
| The ip package through 2.0.1 for Node.js might allow SSRF because
| some IP addresses (such as 127.1, 01200034567, 012.1.2.3,
| 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as
| globally routable via isPublic. NOTE: this issue exists because of
| an incomplete fix for CVE-2023-42282.
https://github.com/indutny/node-ip/issues/150
https://github.com/indutny/node-ip/pull/144
https://github.com/indutny/node-ip/pull/143
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2024-29415
https://www.cve.org/CVERecord?id=CVE-2024-29415
Please adjust the affected versions in the BTS as needed.
The proposed patch changes node-ip behavior and needs recent nodejs. I just
pushed it to experimental to have more test.
Given it was in experimental for almost a year, do you believe it's
ready to land in sid, so that it can make it to trixie?
Cheers,
Moritz
Hi,
sorry for forgotten this. I just pushed it to unstable
