crítica
CVE-2023-42282
nodejs-ip: arbitrary code execution via the isPublic() function
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Azure Linux, CBL-Mariner. Más baja según Red Hat (alta), Ubuntu (media), GHSA (baja).
Descripción
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Azure Linux 3.0 | nodejs | 0:20.14.0-1.azl3 |
| CBL-Mariner 2.0 | nodejs, nodejs18, reaper | 0:16.20.2-3.cm2 y 2 más |
| chainguard | lerna, node-gyp, npm y 2 más | 8.1.2-r1 y 4 más |
| debian 10 | node-ip | sin corrección indicada |
| debian 11 | node-ip | sin corrección indicada |
| debian 12 | node-ip | sin corrección indicada |
| debian 13 | node-ip | 2.0.1+~1.1.3-1 |
| debian 14 | node-ip | 2.0.1+~1.1.3-1 |
| echo | node-ip | 2.0.1+~1.1.3-1 |
| npm::GitHub Security Advisory npm | ip | 2.0.1, 1.1.9 |
| rapidfort debian 12 | node-ip | 0:2.0.1+~1.1.3-1 |
| rapidfort debian 13 | node-ip | 0:2.0.1+~1.1.3-1 |
Mostrar las 39 entradas de 26 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Azure Linux 3.0 | nodejs | 0:20.14.0-1.azl3 |
| CBL-Mariner 2.0 | nodejs | 0:16.20.2-3.cm2 |
| CBL-Mariner 2.0 | nodejs18 | 0:18.18.2-4.cm2 |
| CBL-Mariner 2.0 | reaper | 0:3.1.1-10.cm2 |
| chainguard | lerna | 8.1.2-r1 |
| chainguard | node-gyp | 10.1.0-r0 |
| chainguard | npm | 10.4.0-r1 |
| chainguard | renovate | 37.186.1-r0 |
| chainguard | sqlpad | 7.4.1-r1 |
| debian 10 | node-ip | sin corrección indicada |
| debian 11 | node-ip | sin corrección indicada |
| debian 12 | node-ip | sin corrección indicada |
| debian 13 | node-ip | 2.0.1+~1.1.3-1 |
| debian 14 | node-ip | 2.0.1+~1.1.3-1 |
| echo | node-ip | 2.0.1+~1.1.3-1 |
| npm::GitHub Security Advisory npm | ip | 2.0.1, 1.1.9 |
| rapidfort debian 12 | node-ip | 0:2.0.1+~1.1.3-1 |
| rapidfort debian 13 | node-ip | 0:2.0.1+~1.1.3-1 |
| rapidfort ubuntu 20.04 | node-ip | 0:2.0.0+~1.1.0-1ubuntu0.1 |
| rapidfort ubuntu 20.04 | rf-node-ip | 0:2.0.0+~1.1.0-1ubuntu0.1 |
| rapidfort ubuntu 22.04 | node-ip | 0:2.0.0+~1.1.0-1ubuntu0.1 |
| rapidfort ubuntu 22.04 | rf-node-ip | 0:2.0.0+~1.1.0-1ubuntu0.1 |
| rapidfort ubuntu 24.04 | node-ip | 0:2.0.0+~1.1.0-1ubuntu0.1 |
| rapidfort ubuntu 24.04 | rf-node-ip | 0:2.0.0+~1.1.0-1ubuntu0.1 |
| ubuntu 18.04-ESM | node-ip | 1.1.5-1ubuntu0.1~esm1 |
| ubuntu 20.04-ESM | node-ip | 1.1.5-5ubuntu0.1~esm1 |
| ubuntu 22.04 | node-ip | sin corrección indicada |
| ubuntu 23.10 | node-ip | 2.0.0+~1.1.0-1ubuntu0.1 |
| ubuntu 24.04 | node-ip | 2.0.0+~1.1.0-1ubuntu1 |
| ubuntu 24.10 | node-ip | 2.0.0+~1.1.0-1ubuntu1 |
| ubuntu 25.04 | node-ip | 2.0.0+~1.1.0-1ubuntu1 |
| ubuntu 25.10 | node-ip | 2.0.0+~1.1.0-1ubuntu1 |
| ubuntu 26.04 | node-ip | 2.0.0+~1.1.0-1ubuntu1 |
| ubuntu 26.10 | node-ip | 2.0.0+~1.1.0-1ubuntu1 |
| wolfi | lerna | 8.1.2-r1 |
| wolfi | node-gyp | 10.1.0-r0 |
| wolfi | npm | 10.4.0-r1 |
| wolfi | renovate | 37.186.1-r0 |
| wolfi | sqlpad | 7.4.1-r1 |
Referencias
- https://access.redhat.com/security/cve/CVE-2023-42282
- https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html
- https://github.com/JoshGlazebrook/socks/issues/93#issue-2128357447
- https://github.com/github/advisory-database/pull/3504#issuecomment-1937179999
- https://github.com/indutny/node-ip
- https://github.com/indutny/node-ip/commit/32f468f1245574785ec080705737a579be1223aa
- https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894
- https://github.com/indutny/node-ip/pull/138
Las 14 referencias
- https://huntr.com/bounties/bfc3b23f-ddc0-4ee7-afab-223b07115ed3/
- https://nvd.nist.gov/vuln/detail/CVE-2023-42282
- https://security.netapp.com/advisory/ntap-20240315-0008/
- https://ubuntu.com/security/notices/USN-6643-1
- https://www.bleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only/
- https://www.cve.org/CVERecord?id=CVE-2023-42282