New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix CVE–2022–33987 #22

Open

debricked-staging wants to merge 1 commit into develop from debricked-fix-CVE_2022_33987-2115f2278938e169

debricked-staging bot commented Oct 7, 2022

CVE–2022–33987

Vulnerable dependency: got (npm) 11.8.2

Vulnerability details

Description

NVD

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

GitHub

Got allows a redirect to a UNIX socket

The got package before 11.8.5 and 12.1.0 for Node.js allows a redirect to a UNIX socket.

CVSS details -

5.3

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity	Low
Availability	None

References

    Got allows a redirect to a UNIX socket · CVE-2022-33987 · GitHub Advisory Database · GitHub
    THIRD PARTY
    Comparing v12.0.3...v12.1.0 · sindresorhus/got · GitHub
    Disable redirects to UNIX sockets by szmarczak · Pull Request #2047 · sindresorhus/got · GitHub
    Release v11.8.5 · sindresorhus/got · GitHub
    Release v12.1.0 · sindresorhus/got · GitHub
    Disable redirects to UNIX sockets (#2047) · sindresorhus/got@861ccd9 · GitHub

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE


          Fix CVE–2022–33987

d9d5a17

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment