CVE-2023-42439

Advisory

Geonode before 4.1.3 is vulnerable to Server-side Request Forgery (SSRF). This could allow a user to request internal services for a full read SSRF, returning any data from the internal network.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Security fixes
- [CVE-2023-42439](https://github.com/GeoNode/geonode/security/advisories/GHSA-pxg5-h34r-7q8p)
- [Restricted user information](https://github.com/GeoNode/geonode/pull/11384) returned by the legacy API v1

Docker
- [Reverted base image to Ubuntu 22.04 LTS](https://github.com/GeoNode/geonode/pull/11488)

You can see the **full list of closed PRs [here](https://github.com/GeoNode/geonode/pulls?q=is%3Apr+milestone%3A4.1.3+is%3Aclosed)**.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42439
• https://github.com/GeoNode/geonode/security/advisories/GHSA-pxg5-h34r-7q8p
• https://github.com/GeoNode/geonode/releases/tag/4.1.3
• https://github.com/GeoNode/geonode/commit/79ac6e70419c2e0261548bed91c159b54ff35b8d