Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBwNTctbXFtaC00NGg3

Command Injection in macaddress

All versions of macaddress are vulnerable to command injection. For this vulnerability to be exploited an attacker needs to control the iface argument to the one method.

Recommendation

Update to version 0.2.9 or later.

Permalink: https://github.com/advisories/GHSA-pp57-mqmh-44h7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBwNTctbXFtaC00NGg3
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 5 years ago
Updated: over 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-pp57-mqmh-44h7, CVE-2018-13797
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-13797
• https://github.com/scravy/node-macaddress/pull/20
• https://hackerone.com/reports/319467
• https://github.com/advisories/GHSA-pp57-mqmh-44h7
• https://www.npmjs.com/advisories/654
• https://github.com/scravy/node-macaddress/pull/20/
• https://github.com/scravy/node-macaddress/commit/358fd594adb196a86b94ac9c691f69fe5dad2332
• https://github.com/scravy/node-macaddress/releases/tag/0.2.9
• https://news.ycombinator.com/item?id=17283394

Repository: https://github.com/scravy/node-macaddress
Blast Radius: 51.7

Affected Packages