Open mend-bolt-for-github[bot] opened 5 months ago
[![](https://badge.fury.io/js/ip.svg)](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy: - gatsby-plugin-sharp-5.13.1.tgz (Root Library) - sharp-0.32.6.tgz - node-gyp-9.4.0.tgz - make-fetch-happen-11.1.1.tgz - socks-proxy-agent-7.0.0.tgz - socks-2.7.1.tgz - :x: **ip-2.0.0.tgz** (Vulnerable Library)
Found in HEAD commit: 50f91e8f19edfee259e1f0672ab3b00104b33d47
Found in base branch: master
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
Publish Date: 2024-02-08
URL: CVE-2023-42282
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-78xj-cgh5-2h22
Release Date: 2024-02-08
Fix Resolution: ip - 1.1.9,2.0.1
Step up your Open Source Security Game with Mend here
CVE-2023-42282 - Critical Severity Vulnerability
Vulnerable Library - ip-2.0.0.tgz
[![](https://badge.fury.io/js/ip.svg)](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy: - gatsby-plugin-sharp-5.13.1.tgz (Root Library) - sharp-0.32.6.tgz - node-gyp-9.4.0.tgz - make-fetch-happen-11.1.1.tgz - socks-proxy-agent-7.0.0.tgz - socks-2.7.1.tgz - :x: **ip-2.0.0.tgz** (Vulnerable Library)
Found in HEAD commit: 50f91e8f19edfee259e1f0672ab3b00104b33d47
Found in base branch: master
Vulnerability Details
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
Publish Date: 2024-02-08
URL: CVE-2023-42282
CVSS 3 Score Details (9.8)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-78xj-cgh5-2h22
Release Date: 2024-02-08
Fix Resolution: ip - 1.1.9,2.0.1
Step up your Open Source Security Game with Mend here