Fix CVE–2021–29418

[debricked]

CVE–2021–29418

Vulnerability details

Description

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

NVD

The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.

CVSS details - 5.3

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity	Low
Availability	None

References

    CVE-2021-29418 Node.js Vulnerability in NetApp Products | NetApp Product Security
    NVD - CVE-2021-29418
    Rewrite byte parsing in full JS without depending on parseInt · rs/node-netmask@3f19a05 · GitHub
    Advisory #6 - RyotaK's Vuln DB
    THIRD PARTY

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE