CVE-2026-101912 (MEDIUM): detected in Lambda Docker Images.

Aperta
  • Qualcosa non va?
#706 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
aws, docker, node.js
Ambito
cloud, infrastructure, security

Direzione di ricerca

Start by locating how the listed Lambda Node.js images obtain the ip-address package at version 10.2.0 and whether each affected image can be rebuilt. Update the package to 10.7.1 for the affected images, then rescan them and confirm the CVE no longer reports the vulnerable version.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

CVE Details

CVE ID Severity Affected Package Installed Version Fixed Version Date Published Date of Scan
CVE-2026-101912 MEDIUM ip-address 10.2.0 10.7.1 2026-09-28T18:17:21.073Z 2026-09-30T10:18:20.696138078Z

Affected Docker Images

Image Name SHA
public.ecr.aws/lambda/nodejs:latest public.ecr.aws/lambda/nodejs@sha256:523ce8499e16c3bff599c94691e1c6a1405aac415c13b95b98dbb9dddd052b77
public.ecr.aws/lambda/nodejs:26-preview public.ecr.aws/lambda/nodejs@sha256:f5118e838e4efe4462b87cb77b1b255170952560a5766ad9c0d3f30016c57800
public.ecr.aws/lambda/nodejs:24 public.ecr.aws/lambda/nodejs@sha256:523ce8499e16c3bff599c94691e1c6a1405aac415c13b95b98dbb9dddd052b77
public.ecr.aws/lambda/nodejs:22 public.ecr.aws/lambda/nodejs@sha256:282bd7028e6d1f365a3a174751634c7a84e12ef8a466cdcf786c3f4d744e743a

Description

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1.

Remediation Steps
  • Update the affected package ip-address from version 10.2.0 to 10.7.1.
About this issue
  • This issue may not contain all the information about the CVE nor the images it affects.
  • This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
  • For more, visit Lambda Watchdog.
  • This issue was created automatically by Lambda Watchdog.
Lingua principale
Nessun dato sulla lingua
Stelle
775
Fork
117
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di aws/aws-lambda-base-images

Tutte le issue di aws/aws-lambda-base-images

Issue simili

Altre issue su Cloud

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.