Node.js 1.1.9 vulnerability in elastic docker agent image CVE-2023-4228

Elastic Stack Elastic Agent
1

This issue is related to docker image elastic-agent-complete (8.12.1, 8.12.2)

According the CVE-2023-4228 the Node.js 1.1.9 version is vulnerable.

Description

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Base Score: 9.8 CRITICAL

Please remediate the vulnerability and provide latest image without vulnerability.

2

Hi @miksonx, thank you for letting us know. Elastic accepts reports / information about security vulnerabilities in Elastic products via security@elastic.co. Could you please send an email to this address? This would kick off the process of addressing this issue.