Homepage

ip@1.1.1 vulnerabilities

  • latest version

    2.0.1

  • first published

    12 years ago

  • latest version published

    1 years ago

  • licenses detected

  • View ip package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the ip package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Server-Side Request Forgery (SSRF)

    ip is a Node library.

    Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) via the isPublic function, which identifies some private IP addresses as public addresses due to improper parsing of the input. An attacker can manipulate a system that uses isLoopback(), isPrivate() and isPublic functions to guard outgoing network requests to treat certain IP addresses as globally routable by supplying specially crafted IP addresses.

    Note

    This vulnerability derived from an incomplete fix for CVE-2023-42282

    How to fix Server-Side Request Forgery (SSRF)?

    There is no fixed version for ip.

    *
    • H
    Server-side Request Forgery (SSRF)

    ip is a Node library.

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the isPublic function, by failing to identify hex-encoded 0x7f.1 as equivalent to the private addess 127.0.0.1. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by exploiting this vulnerability.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade ip to version 1.1.9, 2.0.1 or higher.

    <1.1.9>=2.0.0 <2.0.1
    • M
    Uninitialized Memory Exposure

    ip is an IP address utility for node.js.

    Affected versions of the package are vulnerable to Uninitialized Memory Exposure due to an insecure use of the Node.js Buffer class.

    How to fix Uninitialized Memory Exposure?

    Upgrade ip to version 1.1.5 or higher. Note This is vulnerable only for Node <=4

    <1.1.5
    Go back to all versions of this package