The popular open source project, 'ip' had its GitHub repository archived, or made "read-only" by its developer as a result of a dubious CVE report filed for his project. Unfortunately, open-source developers have recently been met with an uptick in debatable or outright bogus CVEs filed for their projects.
  • NateEnglish
    6·
    6 months ago

    The CVE has to do with the utility not correctly identifying private IP addresses supplied to it in a non-standard format, such as hexadecimal. This would cause the ‘node-ip’ utility to treat a private IP address (in hex format) such as " 0x7F.1…" (which represents 127.1…) as public.

    This is a ridiculous expectation. Providing addresses in an unsupported format doesn’t yield correct results? Who wouldda thunk it. Clean up your fucking code and pass it in as expected, or make your own damn node-ip.