Server-Side Request Forgery (SSRF)

🗓️ 08 Feb 2024 08:37:09Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 22 Views

libuv.so vulnerability to SSRF due to handling of `hostname_ascii` variable length in `uv_getaddrinfo` and `uv__idna_toascii`, allowing access to internal APIs through long hostnames

Reporter	Title	Published	Views	Family All 208
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues	27 Sep 202422:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rational® Application Developer for WebSphere® Software is vulnerable to a denial of service	13 May 202423:54	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of service vulnerabilities in Node.js affects IBM Rational Developer for i RPG and COBOL + Modernization Tools, Java Edition	30 May 202418:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	19 Mar 202417:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js affect IBM Business Automation Workflow	1 Mar 202419:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates	8 Oct 202409:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v4.8.6 is vulnerable to multiple Base OS issues	1 Nov 202422:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js.	10 May 202414:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	15 Apr 202502:53	–	ibm
Tenable Nessus	Amazon Linux 2023 : libuv, libuv-devel, libuv-static (ALAS2023-2024-540)	6 Mar 202400:00	–	nessus

Vulners

Node

libuv libuvMatch1.44.2-r1cpp

AND

libuv libuvMatch1.41.0-r0cpp

AND

libuv libuvMatch1.42.0-r0cpp

AND

libuv libuvMatch1.43.0-r1cpp

AND

libuv libuvMatch1.45.0-r0cpp

AND

libuv libuvMatch1.47.0-r0cpp

AND

libuv libuvMatch1.36.0-r0cpp

AND

libuv libuvMatch1.44.2-r0cpp

AND

libuv libuvMatch1.41.1-r0cpp

AND

libuv libuvMatch1.46.0-r0cpp

AND

libuv libuvMatch1.44.2-r2cpp

AND

libuv libuvMatch1.34.2-r0cpp

AND

libuv libuvMatch1.37.0-r0cpp

AND

libuv libuvMatch1.35.0-r0cpp

AND

libuv libuvMatch1.44.1-r0cpp

AND

libuv libuvMatch1.44.2-r3cpp

AND

alpinelinux alpine_linuxMatchedge

libuv1 libuv1Match1.40.0-1debian

AND

debian debian_linuxMatch999

libuv1 libuv1Match1.24.1-1+deb10u1debian

AND

debian debian_linuxMatch10

libuv1 libuv1Match1.40.0-1debian

AND

debian debian_linuxMatch11

libuv.so libuv.soRange0.10.debug–0.10cpp

Source	Link
github	www.github.com/libuv/libuv/commit/e0327e1d508b8207c9150b6e582f0adf26213c39
github	www.github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70
github	www.github.com/libuv/libuv/commit/c858a147643de38a09dd4164758ae5b685f2b488
github	www.github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629
github	www.github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6
gitlab	www.gitlab.kitware.com/cmake/cmake/-/issues/26112
lists	www.lists.debian.org/debian-lts-announce/2024/03/msg00005.html
security	www.security.netapp.com/advisory/ntap-20240605-0008/
openwall	www.openwall.com/lists/oss-security/2024/02/08/2
openwall	www.openwall.com/lists/oss-security/2024/02/11/1

18 Jul 2024 05:21Current

7High risk

Vulners AI Score7

CVSS 3.17.3

EPSS0.002