CVE-2021-43616
First published: Sat Nov 13 2021(Updated: )
** DISPUTED ** The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json. NOTE: The npm team believes this is not a vulnerability. It would require someone to socially engineer package.json which has different dependencies than package-lock.json. That user would have to have file system or write access to change dependencies. The npm team states preventing malicious actors from socially engineering or gaining file system access is outside the scope of the npm CLI.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Npmjs Npm | >=7.0.0<=7.24.2 | |
| Npmjs Npm | >=8.0.0<=8.1.3 | |
| Netapp Next Generation Application Programming Interface | ||
| Fedoraproject Fedora | =35 | |
| >=7.0.0<=7.24.2 | ||
| >=8.0.0<=8.1.3 | ||
| =35 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.npmjs.com/cli/v7/commands/npm-ci
- https://docs.npmjs.com/cli/v8/commands/npm-ci
- https://github.com/icatalina/CVE-2021-43616
- https://github.com/npm/cli/commit/457e0ae61bbc55846f5af44afa4066921923490f
- https://github.com/npm/cli/issues/2701
- https://github.com/npm/cli/issues/2701#issuecomment-972900511
- https://github.com/npm/cli/issues/2701#issuecomment-979054224
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NXNVFKOF5ZYH5NIRWHKN6O6UBCHDV6FE/
- https://medium.com/cider-sec/this-time-we-were-lucky-85c0dcac94a0
- https://security.netapp.com/advisory/ntap-20211210-0002/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXNVFKOF5ZYH5NIRWHKN6O6UBCHDV6FE/
Frequently Asked Questions
What is CVE-2021-43616?
CVE-2021-43616 is a vulnerability that allows the npm ci command in npm 7.x and 8.x through 8.1.3 to proceed with an installation even if dependency information in package-lock.json differs from package.json.
What is the severity of CVE-2021-43616?
The severity of CVE-2021-43616 is critical with a severity value of 9.8.
How does CVE-2021-43616 make it easier for attackers?
CVE-2021-43616 makes it easier for attackers to install malware that was supposed to be blocked by the package-lock.json file.
Which versions of npm are affected by CVE-2021-43616?
Versions of npm 7.x and 8.x through 8.1.3 are affected by CVE-2021-43616.
How can I fix the vulnerability CVE-2021-43616?
To fix CVE-2021-43616, it is recommended to update npm to a version higher than 8.1.3.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/weakness
- agent/remedy
- agent/references
- agent/status
- agent/softwarecombine
- agent/description
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- status/disputed
- vendor/npmjs
- canonical/npmjs npm
- version/npmjs npm/7.0.0
- version/npmjs npm/7.24.2
- version/npmjs npm/8.0.0
- version/npmjs npm/8.1.3
- vendor/netapp
- canonical/netapp next generation application programming interface
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35