Patchwire CVEs, their patch status, and feeds to follow them

CVE-2022-43548

Fixed in a distro release EPSS 15%CVSS 8.1

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

Published 2022-12-05 · CVE record · OSV

Products: NodeJS Node

Distro releases

ReleasePackageFixed in
AlmaLinux:8nodejs1:16.18.1-3.module_el8.7.0+3371+ed8c43db
AlmaLinux:8nodejs1:14.21.1-2.module_el8.7.0+3373+a4c18c43
AlmaLinux:8nodejs1:18.12.1-2.module_el8.7.0+3370+40ccb2a8
AlmaLinux:8nodejs-devel1:14.21.1-2.module_el8.7.0+3373+a4c18c43
AlmaLinux:8nodejs-devel1:16.18.1-3.module_el8.7.0+3371+ed8c43db
AlmaLinux:8nodejs-devel1:18.12.1-2.module_el8.7.0+3370+40ccb2a8
AlmaLinux:8nodejs-docs1:14.21.1-2.module_el8.7.0+3373+a4c18c43
AlmaLinux:8nodejs-docs1:16.18.1-3.module_el8.7.0+3371+ed8c43db
AlmaLinux:8nodejs-docs1:18.12.1-2.module_el8.7.0+3370+40ccb2a8
AlmaLinux:8nodejs-full-i18n1:14.21.1-2.module_el8.7.0+3373+a4c18c43
AlmaLinux:8nodejs-full-i18n1:16.18.1-3.module_el8.7.0+3371+ed8c43db
AlmaLinux:8nodejs-full-i18n1:18.12.1-2.module_el8.7.0+3370+40ccb2a8
AlmaLinux:8nodejs-nodemon2.0.20-1.module_el8.7.0+3370+40ccb2a8
AlmaLinux:8nodejs-nodemon2.0.20-2.module_el8.7.0+3371+ed8c43db
AlmaLinux:8nodejs-nodemon2.0.20-2.module_el8.7.0+3373+a4c18c43
AlmaLinux:8nodejs-packaging2021.06-4.module_el8.7.0+3343+ea2b7901
AlmaLinux:8nodejs-packaging23-3.module_el8.4.0+2522+3bd42762
AlmaLinux:8nodejs-packaging25-1.module_el8.5.0+2605+45d748af
AlmaLinux:8nodejs-packaging-bundler2021.06-4.module_el8.7.0+3343+ea2b7901
AlmaLinux:8npm1:8.19.2-1.16.18.1.3.module_el8.7.0+3371+ed8c43db
AlmaLinux:8npm1:6.14.17-1.14.21.1.2.module_el8.7.0+3373+a4c18c43
AlmaLinux:8npm1:8.19.2-1.18.12.1.2.module_el8.7.0+3370+40ccb2a8
AlmaLinux:9nodejs1:16.18.1-3.el9_1
AlmaLinux:9nodejs1:18.12.1-1.module_el9.1.0+16+91bc168f
AlmaLinux:9nodejs-devel1:18.12.1-1.module_el9.1.0+16+91bc168f
AlmaLinux:9nodejs-docs1:16.18.1-3.el9_1
AlmaLinux:9nodejs-docs1:18.12.1-1.module_el9.1.0+16+91bc168f
AlmaLinux:9nodejs-full-i18n1:16.18.1-3.el9_1
AlmaLinux:9nodejs-full-i18n1:18.12.1-1.module_el9.1.0+16+91bc168f
AlmaLinux:9nodejs-libs1:16.18.1-3.el9_1
AlmaLinux:9nodejs-nodemon2.0.20-1.module_el9.1.0+16+91bc168f
AlmaLinux:9nodejs-nodemon2.0.20-2.el9_1
AlmaLinux:9nodejs-packaging2021.06-4.module_el9.1.0+13+d9a595ea
AlmaLinux:9nodejs-packaging-bundler2021.06-4.module_el9.1.0+13+d9a595ea
AlmaLinux:9npm1:8.19.2-1.18.12.1.1.module_el9.1.0+16+91bc168f
AlmaLinux:9npm1:8.19.2-1.16.18.1.3.el9_1
Alpine:v3.17nodejs18.12.1-r0
Alpine:v3.18nodejs18.12.1-r0
Alpine:v3.19nodejs18.12.1-r0
Alpine:v3.20nodejs18.12.1-r0
Alpine:v3.21nodejs18.12.1-r0
Alpine:v3.22nodejs18.12.1-r0
Alpine:v3.23nodejs18.12.1-r0
Alpine:v3.24nodejs18.12.1-r0
Debian:10nodejs10.24.0~dfsg-1~deb10u3
Debian:11nodejs12.22.12~dfsg-1~deb11u3
Debian:12nodejs18.12.1+dfsg-1
Debian:13nodejs18.12.1+dfsg-1
Debian:14nodejs18.12.1+dfsg-1
Red Hat:enterprise_linux:8nodejs1:14.21.1-2.module+el8.7.0+17528+a329cd47
Red Hat:enterprise_linux:8nodejs1:16.18.1-3.module+el8.7.0+17465+1a1abd74
Red Hat:enterprise_linux:8nodejs1:18.12.1-2.module+el8.7.0+17306+fc023f99
Red Hat:enterprise_linux:8nodejs-debuginfo1:18.12.1-2.module+el8.7.0+17306+fc023f99
Red Hat:enterprise_linux:8nodejs-debuginfo1:16.18.1-3.module+el8.7.0+17465+1a1abd74
Red Hat:enterprise_linux:8nodejs-debuginfo1:14.21.1-2.module+el8.7.0+17528+a329cd47
Red Hat:enterprise_linux:8nodejs-debugsource1:14.21.1-2.module+el8.7.0+17528+a329cd47
Red Hat:enterprise_linux:8nodejs-debugsource1:16.18.1-3.module+el8.7.0+17465+1a1abd74
Red Hat:enterprise_linux:8nodejs-debugsource1:18.12.1-2.module+el8.7.0+17306+fc023f99
Red Hat:enterprise_linux:8nodejs-devel1:16.18.1-3.module+el8.7.0+17465+1a1abd74
Red Hat:enterprise_linux:8nodejs-devel1:14.21.1-2.module+el8.7.0+17528+a329cd47
Red Hat:enterprise_linux:8nodejs-devel1:18.12.1-2.module+el8.7.0+17306+fc023f99
Red Hat:enterprise_linux:8nodejs-docs1:16.18.1-3.module+el8.7.0+17465+1a1abd74
Red Hat:enterprise_linux:8nodejs-docs1:14.21.1-2.module+el8.7.0+17528+a329cd47
Red Hat:enterprise_linux:8nodejs-docs1:18.12.1-2.module+el8.7.0+17306+fc023f99
Red Hat:enterprise_linux:8nodejs-full-i18n1:16.18.1-3.module+el8.7.0+17465+1a1abd74
Red Hat:enterprise_linux:8nodejs-full-i18n1:18.12.1-2.module+el8.7.0+17306+fc023f99
Red Hat:enterprise_linux:8nodejs-full-i18n1:14.21.1-2.module+el8.7.0+17528+a329cd47
Red Hat:enterprise_linux:8nodejs-nodemon0:2.0.20-1.module+el8.7.0+17282+f47dd33b
Red Hat:enterprise_linux:8nodejs-nodemon0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b
Red Hat:enterprise_linux:8nodejs-nodemon0:2.0.20-2.module+el8.7.0+17528+a329cd47
Red Hat:enterprise_linux:8nodejs-packaging0:23-3.module+el8.3.0+6519+9f98ed83
Red Hat:enterprise_linux:8nodejs-packaging0:2021.06-4.module+el8.7.0+15582+19c314fa
Red Hat:enterprise_linux:8nodejs-packaging0:25-1.module+el8.5.0+10992+fac5fe06
Red Hat:enterprise_linux:8nodejs-packaging-bundler0:2021.06-4.module+el8.7.0+15582+19c314fa
Red Hat:enterprise_linux:8npm1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99
Red Hat:enterprise_linux:8npm1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47
Red Hat:enterprise_linux:8npm1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74
Red Hat:enterprise_linux:9nodejs1:18.12.1-1.module+el9.1.0.z+17326+318294bb
Red Hat:enterprise_linux:9nodejs1:16.18.1-3.el9_1
Red Hat:enterprise_linux:9nodejs-debuginfo1:18.12.1-1.module+el9.1.0.z+17326+318294bb
Red Hat:enterprise_linux:9nodejs-debuginfo1:16.18.1-3.el9_1
Red Hat:enterprise_linux:9nodejs-debugsource1:18.12.1-1.module+el9.1.0.z+17326+318294bb
Red Hat:enterprise_linux:9nodejs-debugsource1:16.18.1-3.el9_1
Red Hat:enterprise_linux:9nodejs-devel1:18.12.1-1.module+el9.1.0.z+17326+318294bb
Red Hat:enterprise_linux:9nodejs-docs1:16.18.1-3.el9_1
Red Hat:enterprise_linux:9nodejs-docs1:18.12.1-1.module+el9.1.0.z+17326+318294bb
Red Hat:enterprise_linux:9nodejs-full-i18n1:16.18.1-3.el9_1
Red Hat:enterprise_linux:9nodejs-full-i18n1:18.12.1-1.module+el9.1.0.z+17326+318294bb
Red Hat:enterprise_linux:9nodejs-libs1:16.18.1-3.el9_1
Red Hat:enterprise_linux:9nodejs-libs-debuginfo1:16.18.1-3.el9_1
Red Hat:enterprise_linux:9nodejs-nodemon0:2.0.20-2.el9_1
Red Hat:enterprise_linux:9nodejs-nodemon0:2.0.20-1.module+el9.1.0.z+17326+318294bb
Red Hat:enterprise_linux:9nodejs-packaging0:2021.06-4.module+el9.1.0+15718+e52ec601
Red Hat:enterprise_linux:9nodejs-packaging-bundler0:2021.06-4.module+el9.1.0+15718+e52ec601
Red Hat:enterprise_linux:9npm1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb
Red Hat:enterprise_linux:9npm1:8.19.2-1.16.18.1.3.el9_1
Red Hat:rhel_eus:8.4nodejs1:14.21.3-1.module+el8.4.0+18317+43f5ac16
Red Hat:rhel_eus:8.4nodejs-debuginfo1:14.21.3-1.module+el8.4.0+18317+43f5ac16
Red Hat:rhel_eus:8.4nodejs-debugsource1:14.21.3-1.module+el8.4.0+18317+43f5ac16
Red Hat:rhel_eus:8.4nodejs-devel1:14.21.3-1.module+el8.4.0+18317+43f5ac16
Red Hat:rhel_eus:8.4nodejs-docs1:14.21.3-1.module+el8.4.0+18317+43f5ac16
Red Hat:rhel_eus:8.4nodejs-full-i18n1:14.21.3-1.module+el8.4.0+18317+43f5ac16
Red Hat:rhel_eus:8.4nodejs-nodemon0:2.0.20-3.module+el8.4.0+18317+43f5ac16
Red Hat:rhel_eus:8.4nodejs-packaging0:23-3.module+el8.3.0+6519+9f98ed83
Red Hat:rhel_eus:8.4npm1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16
Red Hat:rhel_eus:8.6nodejs1:14.21.3-1.module+el8.6.0+18532+cbe6f646
Red Hat:rhel_eus:8.6nodejs-debuginfo1:14.21.3-1.module+el8.6.0+18532+cbe6f646
Red Hat:rhel_eus:8.6nodejs-debugsource1:14.21.3-1.module+el8.6.0+18532+cbe6f646
Red Hat:rhel_eus:8.6nodejs-devel1:14.21.3-1.module+el8.6.0+18532+cbe6f646
Red Hat:rhel_eus:8.6nodejs-docs1:14.21.3-1.module+el8.6.0+18532+cbe6f646
Red Hat:rhel_eus:8.6nodejs-full-i18n1:14.21.3-1.module+el8.6.0+18532+cbe6f646
Red Hat:rhel_eus:8.6nodejs-nodemon0:2.0.20-3.module+el8.6.0+18532+cbe6f646
Red Hat:rhel_eus:8.6nodejs-packaging0:23-3.module+el8.3.0+6519+9f98ed83
Red Hat:rhel_eus:8.6npm1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646
Red Hat:rhel_software_collections:3rh-nodejs14-nodejs0:14.21.1-3.el7
Red Hat:rhel_software_collections:3rh-nodejs14-nodejs-debuginfo0:14.21.1-3.el7
Red Hat:rhel_software_collections:3rh-nodejs14-nodejs-devel0:14.21.1-3.el7
Red Hat:rhel_software_collections:3rh-nodejs14-nodejs-docs0:14.21.1-3.el7
Red Hat:rhel_software_collections:3rh-nodejs14-nodejs-full-i18n0:14.21.1-3.el7
Red Hat:rhel_software_collections:3rh-nodejs14-nodejs-nodemon0:2.0.20-2.el7
Red Hat:rhel_software_collections:3rh-nodejs14-npm0:6.14.17-14.21.1.3.el7
Rocky Linux:8nodejs1:18.12.1-2.module+el8.7.0+1104+549f92a6
Rocky Linux:8nodejs1:14.21.1-2.module+el8.7.0+1116+bd2a84b4
Rocky Linux:8nodejs1:16.18.1-3.module+el8.7.0+1108+49363b0d
Rocky Linux:8nodejs-nodemon0:2.0.20-1.module+el8.7.0+1104+549f92a6
Rocky Linux:8nodejs-nodemon0:2.0.20-2.module+el8.7.0+1108+49363b0d
Rocky Linux:8nodejs-packaging0:25-1.module+el8.6.0+1046+80feca58
Rocky Linux:8nodejs-packaging0:25-1.module+el8.5.0+702+221f14e6
Rocky Linux:8nodejs-packaging0:23-3.module+el8.5.0+733+de4fee6c
Rocky Linux:8nodejs-packaging0:23-3.module+el8.3.0+100+234774f7
Rocky Linux:8nodejs-packaging0:2021.06-4.module+el8.7.0+1072+5b168780
Rocky Linux:8nodejs-packaging0:23-3.module+el8.7.0+1071+4bdda2a8
Rocky Linux:9nodejs1:16.18.1-3.el9_1
Rocky Linux:9nodejs-nodemon0:2.0.20-2.el9_1
Rocky Linux:9nodejs-packaging0:2021.06-4.module+el9.6.0+32322+a8b1fd01
Rocky Linux:9nodejs-packaging0:2021.06-4.module+el9.6.0+32048+5323bb50
Rocky Linux:9nodejs-packaging0:2021.06-4.module+el9.6.0+32144+1d29a396
Rocky Linux:9nodejs-packaging0:2021.06-4.module+el9.6.0+32185+bd121a25
Rocky Linux:9nodejs-packaging0:2021.06-4.module+el9.5.0+31770+0da7192d
Rocky Linux:9nodejs-packaging0:2021.06-4.module+el9.6.0+32143+ae966e5b
Rocky Linux:9nodejs-packaging0:2021.06-4.module+el9.6.0+32045+2e5d342d
SUSE:Enterprise Storage 6nodejs1010.24.1-150000.1.53.1
SUSE:Enterprise Storage 7nodejs1010.24.1-150000.1.53.1
SUSE:Enterprise Storage 7nodejs1212.22.12-150200.4.41.2
SUSE:Enterprise Storage 7nodejs1414.21.1-150200.15.40.2
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOSnodejs1010.24.1-150000.1.53.1
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSSnodejs1010.24.1-150000.1.53.1
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOSnodejs1010.24.1-150000.1.53.1
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOSnodejs1212.22.12-150200.4.41.2
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOSnodejs1414.21.1-150200.15.40.2
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSSnodejs1010.24.1-150000.1.53.1
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSSnodejs1212.22.12-150200.4.41.2
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSSnodejs1414.21.1-150200.15.40.2
SUSE:Linux Enterprise High Performance Computing 15-ESPOSnodejs1010.24.1-150000.1.53.1
SUSE:Linux Enterprise High Performance Computing 15-LTSSnodejs1010.24.1-150000.1.53.1
SUSE:Linux Enterprise Module for Web and Scripting 12nodejs1212.22.12-1.57.1
SUSE:Linux Enterprise Module for Web and Scripting 12nodejs1414.21.1-6.37.1
SUSE:Linux Enterprise Module for Web and Scripting 12nodejs1616.18.1-8.17.1
SUSE:Linux Enterprise Module for Web and Scripting 12nodejs1818.13.0-8.3.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3nodejs1212.22.12-150200.4.41.2
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3nodejs1414.21.1-150200.15.40.2
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3nodejs1616.18.1-150300.7.15.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4nodejs1616.18.1-150400.3.12.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4nodejs1818.13.0-150400.9.3.1
SUSE:Linux Enterprise Server 15 SP1-BCLnodejs1010.24.1-150000.1.53.1
SUSE:Linux Enterprise Server 15 SP1-LTSSnodejs1010.24.1-150000.1.53.1
SUSE:Linux Enterprise Server 15 SP2-BCLnodejs1010.24.1-150000.1.53.1
SUSE:Linux Enterprise Server 15 SP2-BCLnodejs1212.22.12-150200.4.41.2
SUSE:Linux Enterprise Server 15 SP2-BCLnodejs1414.21.1-150200.15.40.2
SUSE:Linux Enterprise Server 15 SP2-LTSSnodejs1010.24.1-150000.1.53.1
SUSE:Linux Enterprise Server 15 SP2-LTSSnodejs1212.22.12-150200.4.41.2
SUSE:Linux Enterprise Server 15 SP2-LTSSnodejs1414.21.1-150200.15.40.2
SUSE:Linux Enterprise Server 15-LTSSnodejs1010.24.1-150000.1.53.1
SUSE:Linux Enterprise Server for SAP Applications 15nodejs1010.24.1-150000.1.53.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP1nodejs1010.24.1-150000.1.53.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP2nodejs1010.24.1-150000.1.53.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP2nodejs1212.22.12-150200.4.41.2
SUSE:Linux Enterprise Server for SAP Applications 15 SP2nodejs1414.21.1-150200.15.40.2
SUSE:Manager Proxy 4.1nodejs1010.24.1-150000.1.53.1
SUSE:Manager Proxy 4.1nodejs1212.22.12-150200.4.41.2
SUSE:Manager Proxy 4.1nodejs1414.21.1-150200.15.40.2
SUSE:Manager Retail Branch Server 4.1nodejs1010.24.1-150000.1.53.1
SUSE:Manager Retail Branch Server 4.1nodejs1212.22.12-150200.4.41.2
SUSE:Manager Retail Branch Server 4.1nodejs1414.21.1-150200.15.40.2
SUSE:Manager Server 4.1nodejs1010.24.1-150000.1.53.1
SUSE:Manager Server 4.1nodejs1212.22.12-150200.4.41.2
SUSE:Manager Server 4.1nodejs1414.21.1-150200.15.40.2
Ubuntu:20.04:LTSnodejs10.19.0~dfsg-3ubuntu1.3
Ubuntu:22.04:LTSnodejs12.22.9~dfsg-1ubuntu3.2
Ubuntu:Pro:18.04:LTSnodejs8.10.0~dfsg-2ubuntu0.4+esm4
openSUSE:Leap 15.3nodejs1010.24.1-150000.1.53.1
openSUSE:Leap 15.3nodejs1212.22.12-150200.4.41.2
openSUSE:Leap 15.3nodejs1414.21.1-150200.15.40.2
openSUSE:Leap 15.3nodejs1616.18.1-150300.7.15.1
openSUSE:Leap 15.4nodejs1010.24.1-150000.1.53.1
openSUSE:Leap 15.4nodejs1212.22.12-150200.4.41.2
openSUSE:Leap 15.4nodejs1414.21.1-150200.15.40.2
openSUSE:Leap 15.4nodejs1616.18.1-150400.3.12.1
openSUSE:Leap 15.4nodejs1818.13.0-150400.9.3.1
openSUSE:Leap 15.5nodejs1818.13.0-150400.9.3.1
openSUSE:Tumbleweednodejs-electron21.3.2-2.1
openSUSE:Tumbleweednodejs1818.12.1-1.1
openSUSE:Tumbleweednodejs1919.0.1-1.1