ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

Open Beginner friendly
#526 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
node.js, typescript
Domain
security

Research direction

Find the dependency manifest that declares ip-address and inspect how the current version is resolved. Update it to 10.3.1, then verify the lockfile and dependency checks reflect the patched version and that the reported leading-zero address vulnerability is no longer present.

Written by the indexing model from the issue text.

Description

The ip-address dependency need a bump to resolve this CVE:

Image

The patched version is: 10.3.1

Dominant language
TypeScript
Stars
36
Forks
50
Avg merge
13h 46m
Merged PRs (30d)
9

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from databricks/databricks-sql-nodejs

All issues in databricks/databricks-sql-nodejs

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.