Improper parsing of octal bytes in netmask
Résumé
Improper parsing of octal bytes in netmask
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
:exclamation: NOTE: The fix for this issue was incomplete. A subsequent fix was made in version 2.0.1 which was assigned CVE-2021-29418 / GHSA-pch5-whg9-qr2r. For complete protection from this vulnerability an upgrade to version 2.0.1 or later is recommended.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Références
- advisory nvd.nist.gov
- advisory nvd.nist.gov
- advisory github.com
- web github.com
- web security.netapp.com
- web sick.codes
- web sick.codes
- web vuln.ryotak.me
- web npmjs.com
- web github.com
- web github.com
- web github.com
- web rootdaemon.com
- web security.netapp.com
- web bleepingcomputer.com