CVE-2022-32212

Published: 14 July 2022

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

Priority

Cvss 3 Severity Score

8.1

Score breakdown

Status

Package	Release	Status
nodejs Launchpad, Ubuntu, Debian	bionic	Released (8.10.0~dfsg-2ubuntu0.4+esm4) Available with Ubuntu Pro
	focal	Released (10.19.0~dfsg-3ubuntu1.3)
	impish	Ignored (end of life)
	jammy	Released (12.22.9~dfsg-1ubuntu3.2)
	kinetic	Ignored (end of life, was needs-triage)
	lunar	Not vulnerable (18.13.0+dfsg1-1ubuntu2)
	mantic	Not vulnerable (18.13.0+dfsg1-1ubuntu2)
	trusty	Not vulnerable (code not present)
	upstream	Needs triage
	xenial	Not vulnerable (code not present)

Severity score breakdown

Parameter	Value
Base score	8.1
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›