CVE-2022-33987

NameCVE-2022-33987
DescriptionThe got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1013264

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
node-got (PTS)buster7.1.0-1fixed
bullseye11.8.1+~cs53.13.17-3+deb11u1fixed
sid, trixie, bookworm11.8.5+~cs58.13.36-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
node-gotsourcebuster(not affected)
node-gotsourcebullseye11.8.1+~cs53.13.17-3+deb11u1
node-gotsource(unstable)11.8.3+~cs58.7.37-31013264

Notes

[buster] - node-got <not-affected> (vulnerability introduced later)
https://github.com/sindresorhus/got/pull/2047
Fixed by: https://github.com/sindresorhus/got/commit/861ccd9ac2237df762a9e2beed7edd88c60782dc (v12.1.0)
buster tested against CVE here https://salsa.debian.org/js-team/node-got/-/commit/47a15e189e39c29281532131675a998e1c0a9f8e

Search for package or bug name: Reporting problems