CVE-2022-32212 The IsAllowedHost check can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided (for instance 10.0.2.555 is provided), browsers (such as Firefox) will make DNS requests to the DNS server, providing a vector for an attacker-controlled DNS server or a MITM who can spoof DNS responses to perform a rebinding attack and hence connect to the WebSocket debugger, allowing for arbitrary code execution. This is a bypass of CVE-2021-22884. More details will be available at CVE-2022-32212 after publication. Thank you to Axel Chong for reporting this vulnerability. Impacts: All versions of the 18.x, 16.x, and 14.x releases lines. https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
Created nodejs tracking bugs for this issue: Affects: epel-all [bug 2108518] Affects: fedora-all [bug 2108521] Created nodejs:12/nodejs tracking bugs for this issue: Affects: fedora-all [bug 2108522] Created nodejs:13/nodejs tracking bugs for this issue: Affects: epel-all [bug 2108519] Created nodejs:14/nodejs tracking bugs for this issue: Affects: fedora-all [bug 2108523] Created nodejs:15/nodejs tracking bugs for this issue: Affects: fedora-all [bug 2108524] Created nodejs:16-epel/nodejs tracking bugs for this issue: Affects: epel-all [bug 2108520] Created nodejs:16/nodejs tracking bugs for this issue: Affects: fedora-all [bug 2108525] Created nodejs:18/nodejs tracking bugs for this issue: Affects: fedora-all [bug 2108526]
Respective commits: v14: https://github.com/nodejs/node/commit/48c5aa5cab v16: https://github.com/nodejs/node/commit/754c9bfde0 v18: https://github.com/nodejs/node/commit/e4af5eba95
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Via RHSA-2022:6389 https://access.redhat.com/errata/RHSA-2022:6389
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:6448 https://access.redhat.com/errata/RHSA-2022:6448
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:6449 https://access.redhat.com/errata/RHSA-2022:6449
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:6595 https://access.redhat.com/errata/RHSA-2022:6595
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2022:6985 https://access.redhat.com/errata/RHSA-2022:6985
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-32212