Bug 2050282 (CVE-2021-43616) - CVE-2021-43616 npm: npm ci succeeds when package-lock.json doesn't match package.json
Summary: CVE-2021-43616 npm: npm ci succeeds when package-lock.json doesn't match pack...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-43616
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2050283 2070013 2070015 2050284 2050285 2070011 2070012 2070014
Blocks: 2050286
TreeView+ depends on / blocked
 
Reported: 2022-02-03 15:54 UTC by Pedro Sampaio
Modified: 2022-09-02 13:32 UTC (History)
23 users (show)

Fixed In Version: npm 8.4.1
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in npm. The npm ci command proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json.
Clone Of:
Environment:
Last Closed: 2022-09-02 13:32:58 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2022:4980 0 None None None 2022-06-09 11:49:22 UTC
Red Hat Product Errata RHSA-2022:4796 0 None None None 2022-05-30 12:11:56 UTC

Description Pedro Sampaio 2022-02-03 15:54:51 UTC
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json.

References:

https://docs.npmjs.com/cli/v7/commands/npm-ci
https://github.com/npm/cli/issues/2701
https://github.com/icatalina/CVE-2021-43616
https://medium.com/cider-sec/this-time-we-were-lucky-85c0dcac94a0
https://security.netapp.com/advisory/ntap-20211210-0002/

Comment 1 Pedro Sampaio 2022-02-03 15:55:19 UTC
Created nodejs tracking bugs for this issue:

Affects: epel-7 [bug 2050285]
Affects: fedora-all [bug 2050284]


Created npm tracking bugs for this issue:

Affects: epel-7 [bug 2050283]

Comment 7 errata-xmlrpc 2022-05-30 12:11:53 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:4796 https://access.redhat.com/errata/RHSA-2022:4796

Comment 10 Product Security DevOps Team 2022-09-02 13:32:55 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-43616


Note You need to log in before you can comment on or make changes to this bug.