Fluid Attacks Database

Description

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.18	nodejs	>=0 <18.12.1-r0	18.12.1-r0
debian 13	nodejs	>=0 <18.12.1+dfsg-1	18.12.1+dfsg-1
alpine v3.17	nodejs	>=0 <18.12.1-r0	18.12.1-r0
alpine v3.19	nodejs	>=0 <18.12.1-r0	18.12.1-r0
alpine v3.20	nodejs	>=0 <18.12.1-r0	18.12.1-r0
alpine v3.21	nodejs	>=0 <18.12.1-r0	18.12.1-r0
alpine v3.22	nodejs	>=0 <18.12.1-r0	18.12.1-r0
debian 11	nodejs	=12.21.0~dfsg-5 \|\| =12.22.10~dfsg-1 \|\| =12.22.10~dfsg-2 \|\| =12.22.12~dfsg-1~deb11u1 \|\| =12.22.12~dfsg-1~deb11u2 \|\| =12.22.4~dfsg-1 \|\| =12.22.5~dfsg-1 \|\| =12.22.5~dfsg-2 \|\| =12.22.5~dfsg-2~11u1 \|\| =12.22.5~dfsg-3 \|\| =12.22.5~dfsg-4 \|\| =12.22.5~dfsg-5 \|\| =12.22.5~dfsg-6 \|\| =12.22.5~dfsg-7 \|\| =12.22.7~dfsg-1 \|\| =12.22.7~dfsg-2 \|\| =12.22.9~dfsg-1 \|\| >=0 <12.22.12~dfsg-1~deb11u3	12.22.12~dfsg-1~deb11u3
debian 12	nodejs	>=0 <18.12.1+dfsg-1	18.12.1+dfsg-1
debian 14	nodejs	>=0 <18.12.1+dfsg-1	18.12.1+dfsg-1

1-10 of 17

Aliases

1. CVE-2022-435482. NVD-2022-435483. OSV-ALPINE-2022-435484. OSV-2022-435485. OSV-DEBIAN-2022-435486. GCVE-2022-435487. SECURITY-CVE-2022-435488. SECURITY-TRACKER-CVE-2022-435489. https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43548.json10. security.netapp.com11. security.netapp.com12. DEBIAN-dsa-532613. lists.debian.org

References

1. https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.