CVE-2022-33987

NameCVE-2022-33987
DescriptionThe got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
Debian Bugs1013264

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
node-got (PTS)buster7.1.0-1vulnerable
bullseye11.8.1+~cs53.13.17-3vulnerable
bookworm11.8.3+~cs58.7.37-2vulnerable
sid11.8.3+~cs58.7.37-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
node-gotsource(unstable)11.8.3+~cs58.7.37-31013264

Notes

[bullseye] - node-got <no-dsa> (Minor issue)
[buster] - node-got <no-dsa> (Minor issue)
https://github.com/sindresorhus/got/pull/2047
Fixed by: https://github.com/sindresorhus/got/commit/861ccd9ac2237df762a9e2beed7edd88c60782dc (v12.1.0)

Search for package or bug name: Reporting problems