Test ID:	1.3.6.1.4.1.25623.1.1.12.2023.5973.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-5973-1)
Summary:	The remote host is missing an update for the 'node-url-parse' package(s) announced via the USN-5973-1 advisory.
Description:	Summary: The remote host is missing an update for the 'node-url-parse' package(s) announced via the USN-5973-1 advisory. Vulnerability Insight: It was discovered that url-parse incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service, or to perform a server-side request forgery attack or open redirect attack. (CVE-2018-3774) It was discovered that url-parse incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to bypass input validation. This issue was only fixed in Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-8124) Yaniv Nizry discovered that url-parse incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service, or to perform a server-side request forgery attack or open redirect attack. This issue was only fixed in Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-27515) It was discovered that url-parse incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service, or to perform a server-side request forgery attack or open redirect attack. This issue was only fixed in Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-3664) It was discovered that url-parse incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to bypass authorization. This issue was only fixed in Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0512, CVE-2022-0639, CVE-2022-0691) Rohan Sharma discovered that url-parse incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to bypass authorization. This issue was only fixed in Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0686) Affected Software/OS: 'node-url-parse' package(s) on Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-3774 https://hackerone.com/reports/384029 Common Vulnerability Exposure (CVE) ID: CVE-2020-8124 https://hackerone.com/reports/496293 Common Vulnerability Exposure (CVE) ID: CVE-2021-27515 https://advisory.checkmarx.net/advisory/CX-2021-4306 https://github.com/unshiftio/url-parse/commit/d1e7e8822f26e8a49794b757123b51386325b2b0 https://github.com/unshiftio/url-parse/compare/1.4.7...1.5.0 https://github.com/unshiftio/url-parse/pull/197 https://lists.debian.org/debian-lts-announce/2023/02/msg00030.html Common Vulnerability Exposure (CVE) ID: CVE-2021-3664 https://huntr.dev/bounties/1625557993985-unshiftio/url-parse https://github.com/unshiftio/url-parse/commit/81ab967889b08112d3356e451bf03e6aa0cbb7e0 Common Vulnerability Exposure (CVE) ID: CVE-2022-0512 https://huntr.dev/bounties/6d1bc51f-1876-4f5b-a2c2-734e09e8e05b https://github.com/unshiftio/url-parse/commit/9be7ee88afd2bb04e4d5a1a8da9a389ac13f8c40 Common Vulnerability Exposure (CVE) ID: CVE-2022-0639 https://huntr.dev/bounties/83a6bc9a-b542-4a38-82cd-d995a1481155 https://github.com/unshiftio/url-parse/commit/ef45a1355375a8244063793a19059b4f62fc8788 Common Vulnerability Exposure (CVE) ID: CVE-2022-0686 https://huntr.dev/bounties/55fd06cd-9054-4d80-83be-eb5a454be78c https://github.com/unshiftio/url-parse/commit/d5c64791ef496ca5459ae7f2176a31ea53b127e5 Common Vulnerability Exposure (CVE) ID: CVE-2022-0691 https://huntr.dev/bounties/57124ed5-4b68-4934-8325-2c546257f2e4 https://github.com/unshiftio/url-parse/commit/0e3fb542d60ddbf6933f22eb9b1e06e25eaa5b63
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.