CVE-2023-42282

2024-02-0900:00:00

ubuntu.com

cve-2023-42282

npm ip package

arbitrary code execution

sensitive information

ispublic() function

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.9%

JSON

The ip package before 1.1.9 for Node.js might allow SSRF because some IP
addresses (such as 0x7f.1) are improperly categorized as globally routable
via isPublic.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1063535>

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchnode-ip< 1.1.5-1ubuntu0.1~esm1UNKNOWN
ubuntu20.04noarchnode-ip< 1.1.5-5ubuntu0.1~esm1UNKNOWN
ubuntu22.04noarchnode-ip< 1.1.5+~1.1.0-1ubuntu0.1~esm1UNKNOWN
ubuntu23.10noarchnode-ip< 2.0.0+~1.1.0-1ubuntu0.1UNKNOWN
ubuntu24.04noarchnode-ip< 2.0.0+~1.1.0-1ubuntu1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	node-ip	< 1.1.5-1ubuntu0.1~esm1	UNKNOWN
ubuntu	20.04	noarch	node-ip	< 1.1.5-5ubuntu0.1~esm1	UNKNOWN
ubuntu	22.04	noarch	node-ip	< 1.1.5+~1.1.0-1ubuntu0.1~esm1	UNKNOWN
ubuntu	23.10	noarch	node-ip	< 2.0.0+~1.1.0-1ubuntu0.1	UNKNOWN
ubuntu	24.04	noarch	node-ip	< 2.0.0+~1.1.0-1ubuntu1	UNKNOWN