[Pkg-javascript-devel] Bug#1063535: node-ip: CVE-2023-42282

[Moritz Mühlenhoff]

Source: node-ip
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for node-ip.

CVE-2023-42282[0]:
| An issue in NPM IP Package v.1.1.8 and before allows an attacker to
| execute arbitrary code and obtain sensitive information via the
| isPublic() function.

It seems upstream has been unresponsive to the reports:
https://huntr.com/bounties/bfc3b23f-ddc0-4ee7-afab-223b07115ed3/
https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-42282
    https://www.cve.org/CVERecord?id=CVE-2023-42282

Please adjust the affected versions in the BTS as needed.