Improper Input Validation Affecting ipmatcher Open this link in a new tab package, versions [,1.0.4.2)


0.0
high
  • Exploit Maturity

    Proof of concept

  • Attack Complexity

    Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-DOTNET-IPMATCHER-2826196

  • published

    17 May 2022

  • disclosed

    17 May 2022

  • credit

    Harold Hunt, Kelly Kaoudis, Sick Codes, ohn Jackson, Victor Viale, Nick Sahler, Cheng Xu

How to fix?

Upgrade IpMatcher to version 1.0.4.2 or higher.

Overview

IpMatcher is a C# library for maintaining a match list of IP addresses and networks and comparing inputs to see if a match exists.

Affected versions of this package are vulnerable to Improper Input Validation due to insufficient validation of input IP addresses and netmasks against the internal Matcher list of IP addresses and subnets. Furthermore, IpMatcher does not correctly reformat additions to the match list when these additions (IP address or netmask or both) are supplied in octal or hexadecimal notation.

References