High severity · published Jun 13, 2022
CVE-2022-29244
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie
7.5
CVSS
4%
EPSS
No
On KEV
Description
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.0% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NP
Npm · Npmjs
7.9.0 before 8.11.0 · source: NVD
OS
Ontap Select Deploy Administration Utility · Netapp
All versions, or not specified · source: NVD
Affected product
OS
Ontap Select Deploy Administration Utility
Netapp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-29244
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-29244
Patch
https://github.com/nodejs/node/pull/43210
Release Notes
https://github.com/nodejs/node/releases/tag/v16.15.1
Release Notes
https://github.com/nodejs/node/releases/tag/v17.9.1
Release Notes
https://github.com/nodejs/node/releases/tag/v18.3.0
Release Notes
https://github.com/npm/cli/releases/tag/v8.11.0
Third Party Advisory
https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52
More from Ontap Select Deploy Administration Utility
9.6
CVE-2020-15999
Google Chrome FreeType Heap Buffer Overflow Vulnerability
7.8
CVE-2023-4911
Glibc: buffer overflow in ld.so leading to privilege escalation
7.8
CVE-2021-3156
Sudo Heap-Based Buffer Overflow Vulnerability
7.0
CVE-2016-5195
Linux Kernel Race Condition Vulnerability
9.8
CVE-2024-21990
ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deploy configuration…