A OS Command Injection vulnerability exists in Node.js versi… (CVE-2022-43548)

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami node-min

[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.14.1"},{"introduced":"14.15.0"},{"fixed":"14.21.1"},{"introduced":"16.0.0"},{"fixed":"16.12.1"},{"introduced":"16.13.0"},{"fixed":"16.18.1"},{"introduced":"18.0.0"},{"fixed":"18.11.1"},{"introduced":"18.12.0"},{"fixed":"18.12.1"},{"introduced":"19.0.0"},{"fixed":"19.0.1"}]}]

Bitnami node

[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.14.1"},{"introduced":"14.15.0"},{"fixed":"14.21.1"},{"introduced":"16.0.0"},{"fixed":"16.12.1"},{"introduced":"16.13.0"},{"fixed":"16.18.1"},{"introduced":"18.0.0"},{"fixed":"18.11.1"},{"introduced":"18.12.0"},{"fixed":"18.12.1"},{"introduced":"19.0.0"},{"fixed":"19.0.1"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Alpine Linux ALPINE-CVE-2022-43548 nodejs Corrigé dans: 18.12.1-r0
Debian DEBIAN-CVE-2022-43548 nodejs Corrigé dans: 12.22.12~dfsg-1~deb11u3

Références

advisory security.netapp.com
advisory security.netapp.com
advisory debian.org
advisory nvd.nist.gov
advisory github.com
web lists.debian.org
web nodejs.org