CVE-2023-42282

[joewragg]

Library	Vulnerability	Severity	Status	Installed Version	Fixed Version	Title
ip (package.json)	CVE-2023-42282	Critical	fixed	2.0.0	2.0.1	The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic. https://nvd.nist.gov/vuln/detail/CVE-2023-42282

vroom@vroom-5d59769897-k2rdt:/usr/local/lib/node_modules$ npm ls ip
/usr/local/lib
`-- [email protected] extraneous
  +-- [email protected] extraneous
  `-- [email protected] extraneous
    `-- [email protected] deduped

This has already been fixed in later versions of node:20-bookworm-slim. So fix is to build a new docker image

[jcoupey]

See #84 for the problem currently blocking builds.

[jcoupey]

Probably fixed through #88?

[joewragg]

We should probably release a new version of vroom-docker for these CVE fixes? I think you only release when there's a new version of vroom though right?