kritik
CVE-2021-43616
npm: npm ci succeeds when package-lock.json doesn't match package.json
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (yüksek), AlmaLinux (yüksek), Amazon (yüksek), Oracle (yüksek), Rocky Linux (yüksek), Ubuntu (orta).
Açıklama
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json. NOTE: The npm team believes this is not a vulnerability. It would require someone to socially engineer package.json which has different dependencies than package-lock.json. That user would have to have file system or write access to change dependencies. The npm team states preventing malicious actors from socially engineering or gaining file system access is outside the scope of the npm CLI.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alma 8 | nodejs:16::nodejs, nodejs:16::nodejs-devel, nodejs:16::nodejs-docs ve 4 tane daha | 1:16.14.0-4.module_el8.6.0+2904+f21ad6f4 ve 3 tane daha |
| alpine 3.16 | npm | 8.1.4-r0 |
| alpine 3.17 | npm | 8.1.4-r0 |
| alpine 3.18 | npm | 8.1.4-r0 |
| alpine 3.19 | npm | 8.1.4-r0 |
| alpine 3.20 | npm | 8.1.4-r0 |
| alpine 3.21 | npm | 8.1.4-r0 |
| alpine 3.22 | npm | 8.1.4-r0 |
| alpine 3.23 | npm | 8.1.4-r0 |
| alpine 3.24 | npm | 8.1.4-r0 |
| alpine edge | npm | 8.1.4-r0 |
| amazon linux 2022 | nodejs, nodejs-debuginfo, nodejs-debugsource ve 7 tane daha | 1:18.4.0-1.amzn2022.0.2 ve 2 tane daha |
29 kaynaktaki 70 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alma 8 | nodejs:16::nodejs | 1:16.14.0-4.module_el8.6.0+2904+f21ad6f4 |
| alma 8 | nodejs:16::nodejs-devel | 1:16.14.0-4.module_el8.6.0+2904+f21ad6f4 |
| alma 8 | nodejs:16::nodejs-docs | 1:16.14.0-4.module_el8.6.0+2904+f21ad6f4 |
| alma 8 | nodejs:16::nodejs-full-i18n | 1:16.14.0-4.module_el8.6.0+2904+f21ad6f4 |
| alma 8 | nodejs:16::nodejs-nodemon | 2.0.15-1.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-packaging | 25-1.module_el8.5.0+246+05401605 |
| alma 8 | nodejs:16::npm | 1:8.3.1-1.16.14.0.4.module_el8.6.0+2904+f21ad6f4 |
| alpine 3.16 | npm | 8.1.4-r0 |
| alpine 3.17 | npm | 8.1.4-r0 |
| alpine 3.18 | npm | 8.1.4-r0 |
| alpine 3.19 | npm | 8.1.4-r0 |
| alpine 3.20 | npm | 8.1.4-r0 |
| alpine 3.21 | npm | 8.1.4-r0 |
| alpine 3.22 | npm | 8.1.4-r0 |
| alpine 3.23 | npm | 8.1.4-r0 |
| alpine 3.24 | npm | 8.1.4-r0 |
| alpine edge | npm | 8.1.4-r0 |
| amazon linux 2022 | nodejs | 1:18.4.0-1.amzn2022.0.2 |
| amazon linux 2022 | nodejs-debuginfo | 1:18.4.0-1.amzn2022.0.2 |
| amazon linux 2022 | nodejs-debugsource | 1:18.4.0-1.amzn2022.0.2 |
| amazon linux 2022 | nodejs-devel | 1:18.4.0-1.amzn2022.0.2 |
| amazon linux 2022 | nodejs-docs | 1:18.4.0-1.amzn2022.0.2 |
| amazon linux 2022 | nodejs-full-i18n | 1:18.4.0-1.amzn2022.0.2 |
| amazon linux 2022 | nodejs-libs | 1:18.4.0-1.amzn2022.0.2 |
| amazon linux 2022 | nodejs-libs-debuginfo | 1:18.4.0-1.amzn2022.0.2 |
| amazon linux 2022 | npm | 1:8.12.1-1.18.4.0.1.amzn2022.0.2 |
| amazon linux 2022 | v8-devel | 2:10.2.154.4-1.18.4.0.1.amzn2022.0.2 |
| amazon linux 2023 | nodejs | 1:18.12.1-1.amzn2023.0.2 |
| amazon linux 2023 | nodejs-debuginfo | 1:18.12.1-1.amzn2023.0.2 |
| amazon linux 2023 | nodejs-debugsource | 1:18.12.1-1.amzn2023.0.2 |
| amazon linux 2023 | nodejs-devel | 1:18.12.1-1.amzn2023.0.2 |
| amazon linux 2023 | nodejs-docs | 1:18.12.1-1.amzn2023.0.2 |
| amazon linux 2023 | nodejs-full-i18n | 1:18.12.1-1.amzn2023.0.2 |
| amazon linux 2023 | nodejs-libs | 1:18.12.1-1.amzn2023.0.2 |
| amazon linux 2023 | nodejs-libs-debuginfo | 1:18.12.1-1.amzn2023.0.2 |
| amazon linux 2023 | npm | 1:8.19.2-1.18.12.1.1.amzn2023.0.2 |
| amazon linux 2023 | v8-devel | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.2 |
| debian 10 | npm | düzeltme belirtilmemiş |
| debian 11 | npm | düzeltme belirtilmemiş |
| debian 12 | npm | 8.4.1~ds-1 |
| debian 13 | npm | 8.4.1~ds-1 |
| debian 14 | npm | 8.4.1~ds-1 |
| echo | npm | 8.4.1~ds-1 |
| Oracle Linux 8 | nodejs | 1:16.14.0-4.module+el8.6.0+20672+19f3909b |
| Oracle Linux 8 | nodejs-devel | 1:16.14.0-4.module+el8.6.0+20672+19f3909b |
| Oracle Linux 8 | nodejs-docs | 1:16.14.0-4.module+el8.6.0+20672+19f3909b |
| Oracle Linux 8 | nodejs-full-i18n | 1:16.14.0-4.module+el8.6.0+20672+19f3909b |
| Oracle Linux 8 | nodejs-nodemon | 2.0.15-1.module+el8.6.0+20672+19f3909b |
| Oracle Linux 8 | nodejs-packaging | 25-1.module+el8.5.0+20388+4b61e68d |
| Oracle Linux 8 | npm | 1:8.3.1-1.16.14.0.4.module+el8.6.0+20672+19f3909b |
| rapidfort amazon linux 2023 | nodejs | 1:18.12.1-1.amzn2023.0.2 |
| rapidfort ubuntu 20.04 | npm | düzeltme belirtilmemiş |
| rapidfort ubuntu 22.04 | npm | düzeltme belirtilmemiş |
| rapidfort ubuntu 24.04 | npm | düzeltme belirtilmemiş |
| rocky 8 | nodejs | 1:16.14.0-4.module+el8.6.0+978+59f26232 |
| rocky 8 | nodejs-devel | 1:16.14.0-4.module+el8.6.0+978+59f26232 |
| rocky 8 | nodejs-docs | 1:16.14.0-4.module+el8.6.0+978+59f26232 |
| rocky 8 | nodejs-full-i18n | 1:16.14.0-4.module+el8.6.0+978+59f26232 |
| rocky 8 | nodejs:16::nodejs | 1:16.14.0-4.module+el8.6.0+978+59f26232 |
| rocky 8 | nodejs:16::nodejs-devel | 1:16.14.0-4.module+el8.6.0+978+59f26232 |
| rocky 8 | nodejs:16::nodejs-docs | 1:16.14.0-4.module+el8.6.0+978+59f26232 |
| rocky 8 | nodejs:16::nodejs-full-i18n | 1:16.14.0-4.module+el8.6.0+978+59f26232 |
| rocky 8 | nodejs:16::nodejs-nodemon | 2.0.15-1.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-packaging | 25-1.module+el8.6.0+1046+80feca58 |
| rocky 8 | nodejs:16::npm | 1:8.3.1-1.16.14.0.4.module+el8.6.0+978+59f26232 |
| rocky 8 | npm | 1:8.3.1-1.16.14.0.4.module+el8.6.0+978+59f26232 |
| ubuntu 22.04 | npm | düzeltme belirtilmemiş |
| ubuntu 24.04 | npm | düzeltme belirtilmemiş |
| ubuntu 26.04 | npm | düzeltme belirtilmemiş |
| ubuntu 26.10 | npm | düzeltme belirtilmemiş |
Referanslar
- https://access.redhat.com/security/cve/CVE-2021-43616
- https://bugzilla.redhat.com/show_bug.cgi?id=2050282
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43616
- https://docs.npmjs.com/cli/v7/commands/npm-ci
- https://docs.npmjs.com/cli/v8/commands/npm-ci
- https://errata.almalinux.org/8/ALSA-2022-4796.html
- https://errata.rockylinux.org/RLSA-2022:4796
- https://github.com/icatalina/CVE-2021-43616
19 referansın hepsi
- https://github.com/npm/cli/commit/457e0ae61bbc55846f5af44afa4066921923490f
- https://github.com/npm/cli/issues/2701
- https://github.com/npm/cli/issues/2701#issuecomment-972900511
- https://github.com/npm/cli/issues/2701#issuecomment-979054224
- https://linux.oracle.com/cve/CVE-2021-43616.html
- https://linux.oracle.com/errata/ELSA-2022-4796.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NXNVFKOF5ZYH5NIRWHKN6O6UBCHDV6FE/
- https://medium.com/cider-sec/this-time-we-were-lucky-85c0dcac94a0
- https://nvd.nist.gov/vuln/detail/CVE-2021-43616
- https://security.netapp.com/advisory/ntap-20211210-0002/
- https://www.cve.org/CVERecord?id=CVE-2021-43616