Server-Side Request Forgery (SSRF) Affecting renovate package, versions <37.186.1-r0
Threat Intelligence
EPSS
0.08% (37th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-CHAINGUARDLATEST-RENOVATE-6245277
- published 13 Feb 2024
- disclosed 8 Feb 2024
Introduced: 8 Feb 2024
CVE-2023-42282 Open this link in a new tabHow to fix?
Upgrade Chainguard renovate to version 37.186.1-r0 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream renovate package and not the renovate package as distributed by Chainguard.
See How to fix? for Chainguard relevant fixed versions and status.
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
References
- https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html
- https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894
- https://huntr.com/bounties/bfc3b23f-ddc0-4ee7-afab-223b07115ed3/
- https://security.netapp.com/advisory/ntap-20240315-0008/
- https://www.bleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only/
CVSS Scores
version 3.1