[Pkg-javascript-devel] Bug#1072121: Bug#1072121: node-ip: CVE-2024-29415

[Yadd]

On 4/22/25 15:39, Moritz Mühlenhoff wrote:
> Am Wed, May 29, 2024 at 10:26:24AM +0400 schrieb Yadd:
>> On 5/29/24 00:40, Moritz Mühlenhoff wrote:
>>> Source: node-ip
>>> X-Debbugs-CC: team at security.debian.org
>>> Severity: important
>>> Tags: security
>>>
>>> Hi,
>>>
>>> The following vulnerability was published for node-ip.
>>>
>>> CVE-2024-29415[0]:
>>> | The ip package through 2.0.1 for Node.js might allow SSRF because
>>> | some IP addresses (such as 127.1, 01200034567, 012.1.2.3,
>>> | 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as
>>> | globally routable via isPublic. NOTE: this issue exists because of
>>> | an incomplete fix for CVE-2023-42282.
>>>
>>> https://github.com/indutny/node-ip/issues/150
>>> https://github.com/indutny/node-ip/pull/144
>>> https://github.com/indutny/node-ip/pull/143
>>>
>>>
>>> If you fix the vulnerability please also make sure to include the
>>> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
>>>
>>> For further information see:
>>>
>>> [0] https://security-tracker.debian.org/tracker/CVE-2024-29415
>>>       https://www.cve.org/CVERecord?id=CVE-2024-29415
>>>
>>> Please adjust the affected versions in the BTS as needed.
>>
>> The proposed patch changes node-ip behavior and needs recent nodejs. I just
>> pushed it to experimental to have more test.
> 
> Given it was in experimental for almost a year, do you believe it's
> ready to land in sid, so that it can make it to trixie?
> 
> Cheers,
>          Moritz

Hi,

sorry for forgotten this. I just pushed it to unstable