proxy-agent-6.3.1.tgz: 1 vulnerabilities (highest severity is: 9.8) - autoclosed
mend-for-github-com opened this issue · comments
Vulnerable Library - proxy-agent-6.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ip/package.json
Found in HEAD commit: 9675a20c0ad6863d8410d9d6825e34c2f924ee9b
Vulnerabilities
CVE | Severity | CVSS | Dependency | Type | Fixed in (proxy-agent version) | Remediation Possible** | Reachability |
---|---|---|---|---|---|---|---|
CVE-2023-42282 | Critical | 9.8 | detected in multiple dependencies | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-42282
Vulnerable Libraries - ip-2.0.0.tgz, ip-1.1.8.tgz
ip-2.0.0.tgz
[![](https://badge.fury.io/js/ip.svg)](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/socks/node_modules/ip/package.json
Dependency Hierarchy:
- proxy-agent-6.3.1.tgz (Root Library)
- socks-proxy-agent-8.0.2.tgz
- socks-2.7.1.tgz
- ❌ ip-2.0.0.tgz (Vulnerable Library)
- socks-2.7.1.tgz
- socks-proxy-agent-8.0.2.tgz
ip-1.1.8.tgz
[![](https://badge.fury.io/js/ip.svg)](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ip/package.json
Dependency Hierarchy:
- proxy-agent-6.3.1.tgz (Root Library)
- pac-proxy-agent-7.0.1.tgz
- pac-resolver-7.0.0.tgz
- ❌ ip-1.1.8.tgz (Vulnerable Library)
- pac-resolver-7.0.0.tgz
- pac-proxy-agent-7.0.1.tgz
Found in HEAD commit: 9675a20c0ad6863d8410d9d6825e34c2f924ee9b
Found in base branch: main
Vulnerability Details
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
Publish Date: 2024-02-08
URL: CVE-2023-42282
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-42282
Release Date: 2024-02-08
Fix Resolution: ip - 2.0.0
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.