[Pkg-javascript-devel] Bug#1072121: Bug#1072121: node-ip: CVE-2024-29415

[Yadd]

On 5/29/24 00:40, Moritz Mühlenhoff wrote:
> Source: node-ip
> X-Debbugs-CC: team at security.debian.org
> Severity: important
> Tags: security
> 
> Hi,
> 
> The following vulnerability was published for node-ip.
> 
> CVE-2024-29415[0]:
> | The ip package through 2.0.1 for Node.js might allow SSRF because
> | some IP addresses (such as 127.1, 01200034567, 012.1.2.3,
> | 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as
> | globally routable via isPublic. NOTE: this issue exists because of
> | an incomplete fix for CVE-2023-42282.
> 
> https://github.com/indutny/node-ip/issues/150
> https://github.com/indutny/node-ip/pull/144
> https://github.com/indutny/node-ip/pull/143
> 
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2024-29415
>      https://www.cve.org/CVERecord?id=CVE-2024-29415
> 
> Please adjust the affected versions in the BTS as needed.

The proposed patch changes node-ip behavior and needs recent nodejs. I 
just pushed it to experimental to have more test.