CVE-2022-29244
npm packing does not respect root-level ignore files in workspaces
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.
npm pack ignora las directivas de exclusión de archivos .gitignore y .npmignore a nivel de root cuando es ejecutado en un espacio de trabajo o con un flag de espacio de trabajo (es decir, "--workspaces", "--workspace=(name)"). Cualquiera que haya ejecutado "npm pack" o "npm publish" dentro de un espacio de trabajo, a partir de v7.9.0 y v7.13.0 respectivamente, puede estar afectado y haber publicado archivos en el registro de npm que no tenía intención de incluir. Los usuarios deben actualizar a la última versión parcheada de npm v8.11.0, ejecutar: npm i -g npm@latest . Las versiones de Node.js versiones v16.15.1, v17.19.1 y v18.3.0 incluyen la versión parcheada v8.11.0 de npm
A flaw was found in npm. This security issue occurs because the npm pack ignores root-level ".gitignore" and ".npmignore" file exclusion directives when run in a workspace or with a workspace flag (for example, --workspaces, --workspace=<name>). Anyone who has run 'npm pack' or 'npm publish' inside a workspace has published files into the npm registry they did not intend to include. This flaw exposes sensitive information to an unauthorized user or an attacker.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-04-13 CVE Reserved
- 2022-06-13 CVE Published
- 2024-01-04 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
CAPEC
References (12)
| URL | Tag | Source |
|---|---|---|
| https://github.com/nodejs/node/releases/tag/v16.15.1 | Release Notes | |
| https://github.com/nodejs/node/releases/tag/v17.9.1 | Release Notes | |
| https://github.com/nodejs/node/releases/tag/v18.3.0 | Release Notes | |
| https://github.com/npm/cli/releases/tag/v8.11.0 | Release Notes | |
| https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52 | Third Party Advisory | |
| https://github.com/npm/cli/tree/latest/workspaces/libnpmpack | Product | |
| https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish | Product | |
| https://github.com/npm/npm-packlist | Product | |
| https://security.netapp.com/advisory/ntap-20220722-0007 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/nodejs/node/pull/43210 | 2022-10-27 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2022-29244 | 2022-09-20 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2098556 | 2022-09-20 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Npmjs Search vendor "Npmjs" | Npm Search vendor "Npmjs" for product "Npm" | >= 7.9.0 < 8.11.0 Search vendor "Npmjs" for product "Npm" and version " >= 7.9.0 < 8.11.0" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Ontap Select Deploy Administration Utility Search vendor "Netapp" for product "Ontap Select Deploy Administration Utility" | - | - |
Affected
| ||||||