The CVE has to do with the utility not correctly identifying private IP addresses supplied to it in a non-standard format, such as hexadecimal. This would cause the ‘node-ip’ utility to treat a private IP address (in hex format) such as " 0x7F.1…" (which represents 127.1…) as public.
This is a ridiculous expectation. Providing addresses in an unsupported format doesn’t yield correct results? Who wouldda thunk it. Clean up your fucking code and pass it in as expected, or make your own damn node-ip.
This is a ridiculous expectation. Providing addresses in an unsupported format doesn’t yield correct results? Who wouldda thunk it. Clean up your fucking code and pass it in as expected, or make your own damn node-ip.