Improper Input Validation Affecting ipmatcher package, versions [,1.0.4.2)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DOTNET-IPMATCHER-2826196
- published 17 May 2022
- disclosed 17 May 2022
- credit Harold Hunt, Kelly Kaoudis, Sick Codes, ohn Jackson, Victor Viale, Nick Sahler, Cheng Xu
Introduced: 17 May 2022
CVE-2021-33318 Open this link in a new tabHow to fix?
Upgrade IpMatcher to version 1.0.4.2 or higher.
Overview
IpMatcher is a C# library for maintaining a match list of IP addresses and networks and comparing inputs to see if a match exists.
Affected versions of this package are vulnerable to Improper Input Validation due to insufficient validation of input IP addresses and netmasks against the internal Matcher list of IP addresses and subnets. Furthermore, IpMatcher does not correctly reformat additions to the match list when these additions (IP address or netmask or both) are supplied in octal or hexadecimal notation.