Skip to content
Fencer Vulns
high 8.1

CVE-2024-29415 json

ip SSRF improper categorization in isPublic

published 2024-05-27 2 y ago modified 2026-09-10 1 mo ago also GHSA-2p57-rm9w-gvfp , EUVD-2024-1886

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
8.3%
EPSS 8.3% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.

Patch / fix

  • fedorindutny ip 2.0.1
  • node-ip Debian 14, Debian 13 2.0.1+~1.1.3-3

debian advisories DEBIAN-CVE-2024-29415

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-29415 updated cvss 9.8

node-ip: Incomplete fix for CVE-2023-42282

  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Discovery 1 discovery-server-container Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel8 3.17-19
    fixed: vendor fix RHSA-2024:10236
  • Red Hat Cryostat 2 node-ip Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-console-plugin-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/multicluster-engine-console-mce-rhel9 Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8
    +22 more products
    Red Hat OpenShift Service Mesh 2 openshift-service-mesh/openshift-istio-kiali Red Hat 3scale API Management Platform 2 3scale-amp-system Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel8 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-scanner-v4-rhel8, advanced-cluster-security/rhacs-scanner-v4-db-rhel8 Red Hat build of Apache Camel - HawtIO 4 node-ip Red Hat build of Apicurio Registry 2 node-ip Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh-operator-container Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n Red Hat Fuse 7 node-ip Red Hat Integration Camel K 1 node-ip Red Hat JBoss Data Grid 7 node-ip Red Hat JBoss Enterprise Application Platform 7 org.jboss.hal-hal-parent Red Hat JBoss Enterprise Application Platform Expansion Pack org.jboss.hal-hal-parent Red Hat OpenShift Container Platform 4 openshift4/ose-console Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8 Red Hat OpenShift Dev Spaces 3 devspaces/udi-rhel8 3.17-9, devspaces/idea-rhel8 3.17-4, devspaces/server-rhel8 3.17-9, devspaces/traefik-rhel8 3.17-4, devspaces/configbump-rhel8 3.17-4, devspaces/dashboard-rhel8 3.17-25, +5 more Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-query-rhel8, rhosdt/jaeger-ingester-rhel8, rhosdt/jaeger-collector-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-es-rollover-rhel8, +1 more Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/argo-rollouts-rhel8 Red Hat Process Automation 7 node-ip Red Hat Satellite 6 nodejs-node-sass Red Hat Software Collections rh-nodejs14-npm, rh-nodejs14-nodejs, rh-nodejs14-nodejs-14, rh-nodejs14-nodejs-full-i18n
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

8.28% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm ip
<=2.0.1
 no fix listed

Affected products

  • fedorindutny ip

Classification

Weakness
  • CWE-918 Server-Side Request Forgery
  • CWE-941 Incorrectly Specified Destination in a Communication Channel

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.