CVE-2022-43548
Published: 5 December 2022
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
nodejs Launchpad, Ubuntu, Debian |
bionic |
Released
(8.10.0~dfsg-2ubuntu0.4+esm4)
Available with Ubuntu Pro |
| focal |
Released
(10.19.0~dfsg-3ubuntu1.3)
|
|
| jammy |
Released
(12.22.9~dfsg-1ubuntu3.2)
|
|
| kinetic |
Ignored
(end of life, was needs-triage)
|
|
| lunar |
Not vulnerable
(18.13.0+dfsg1-1ubuntu2)
|
|
| mantic |
Not vulnerable
(18.13.0+dfsg1-1ubuntu2)
|
|
| trusty |
Not vulnerable
(code not present)
|
|
| upstream |
Released
(18.12.1+dfsg-1)
|
|
| xenial |
Not vulnerable
(code not present)
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.1 |
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |