CVE-2023-42282 - ip mitigation when using elastic beanstalk

Question

I have environment in EB based on "Node.js 18 running on 64bit Amazon Linux 2023/6.1.4" platform. The EC2 instances created are flagged as "critical" with "CVE-2023-42282 - ip" finding. The Affected packages are Name: ip, Package manager: NPM, installed version 2.0.0. Fixed version 2.0.1. It is not clear how I can update to the fixed version. EB creates the instances. Where/What/how do I upgrade to get the fixed version?

Accepted Answer

Hello.

I think the target package is the one described in the following document.  
https://www.npmjs.com/package/ip

If there are no particular package dependencies, I think the latest version will be installed if you uninstall and then install as shown below.  
```
npm uninstall IP
npm install IP
```

So, please try updating the package with the above command when creating a custom AMI using the steps in the document below.  
https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.customenv.html

Answer

That works! thank you!

CVE-2023-42282 - ip mitigation when using elastic beanstalk

Relevant content