| Name | CVE-2018-3774 |
| Description | Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 906058 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| node-url-parse (PTS) | bullseye | 1.5.3-1+deb11u2 | fixed |
| bookworm | 1.5.10+~1.4.8-2 | fixed | |
| sid, trixie | 1.5.10+~1.4.8-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| node-url-parse | source | stretch | 1.0.5-2+deb9u1 | |||
| node-url-parse | source | (unstable) | 1.2.0-2 | 906058 |
https://hackerone.com/reports/384029
https://github.com/unshiftio/url-parse/commit/53b1794e54d0711ceb52505e0f74145270570d5a
https://github.com/unshiftio/url-parse/commit/d7b582ec1243e8024e60ac0b62d2569c939ef5de