PT-2021-18201 · Netmask · Netmask

Ryotak · Published 2021-03-29 · Updated 2024-02-11 · CVE-2021-29418

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: netmask package versions prior to 2.0.1

Description: The issue arises from the netmask package's mishandling of certain unexpected characters in an IP address string. Specifically, it struggles with octal digits, such as the digit 9, under certain conditions. This can lead to attackers bypassing access control mechanisms that rely on IP addresses.

Recommendations: For versions prior to 2.0.1, update the netmask package to version 2.0.1 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-29418

GHSA-4C7M-WXVM-R7GC

GHSA-PCH5-WHG9-QR2R

Affected Products

Netmask

References · 24

• https://github.com/rs/node-netmask/commit/3f19a056c4eb808ea4a29f234274c67bc5a848f4 · Patch
• https://osv.dev/vulnerability/CVE-2021-29418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28918 · Security Note
• https://osv.dev/vulnerability/GHSA-pch5-whg9-qr2r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29418 · Security Note
• https://osv.dev/vulnerability/GHSA-4c7m-wxvm-r7gc · Vendor Advisory
• https://github.com/rs/node-netmask · Note
• https://github.com/rs/node-netmask/blob/98294cb20695f2c6c36219a4fbcd4744fb8d0682/CHANGELOG.md#v110-mar-18-2021 · Note
• https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md · Note
• https://twitter.com/Ax_Sharma/status/1756919315628957743 · Twitter Post
• https://vuln.ryotak.me/advisories/6 · Note
• https://t.me/tmfeed/118292 · Telegram Post
• https://t.me/opennews/8883 · Telegram Post
• https://security.netapp.com/advisory/ntap-20210604-0001 · Note
• https://sick.codes/sick-2021-011 · Note