【安全漏洞】NPM IP package vulnerable to Server-Side Request Forgery (SSRF) attacks

[xiaweiss]

[email protected] => [email protected] => [email protected]

[xiaweiss]

see pr: https://github.com/ali-sdk/ali-oss/pull/1292

[taltal78]

Hi , I see the PR https://github.com/ali-sdk/ali-oss/pull/1292 got closed... will this be handled ?

[I072744]

This vulnerability still exists... how would this be handled ? urllib latest version is available which is free from vulnerability Thanks

[borisLipmanovich]

Hi @xiaweiss , any updates on this topic? I see the PR https://github.com/ali-sdk/ali-oss/pull/1292 got closed... will this be handled?

[xiaweiss]

@borisLipmanovich PR #1292 closed, but not merged. holy shit!

urllib version is still 2.41.0 https://github.com/ali-sdk/ali-oss/blob/master/package.json#L156

[borisLipmanovich]

@xiaweiss, indeed :) Can anyone handle it?

[xiaweiss]

@borisLipmanovich No one is dealing with it, Alibaba doesn't take security seriously, it can be ignored

[borisLipmanovich]

@xiaweiss, This vulnerability has CVSS 8.6. Maybe you can reopen the PR as it was closed without merging? https://github.com/ali-sdk/ali-oss/pull/1292

[xiaweiss]

@borisLipmanovich please @ repo owner，not me.

[xiaweiss]

I'm just giving feedback, I don't have any access

[YunZZY]

Version 6.21.0 has been released