CVE-2021-43616 Supply chain in n/a
npm ci installs dependencies despite lockfile mismatches, potentially allowing malware installation if package.json is tampered with.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43616?
CVE-2021-43616 is a critical vulnerability in Fedoraproject Fedora, published on 13 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json. NOTE: The npm team believes this is not a vulnerability. It would require someone to socially engineer package.json which has different dependencies than package-lock.json. That user would have to have file system or write access to change dependencies. The npm team states preventing malicious actors from socially engineering or gaining file system access is outside the scope of the npm CLI.
Weakness: CWE-345
Which versions are affected by CVE-2021-43616?
It affects 3 products.
Linux distribution packages (22)
nodejs AlmaLinux:8 | All versions | 1:16.14.0-4.module_el8.6.0+2904+f21ad6f4 |
nodejs-devel AlmaLinux:8 | All versions | 1:16.14.0-4.module_el8.6.0+2904+f21ad6f4 |
nodejs-docs AlmaLinux:8 | All versions | 1:16.14.0-4.module_el8.6.0+2904+f21ad6f4 |
nodejs-full-i18n AlmaLinux:8 | All versions | 1:16.14.0-4.module_el8.6.0+2904+f21ad6f4 |
nodejs-nodemon AlmaLinux:8 | All versions | 2.0.15-1.module_el8.5.0+2605+45d748af |
nodejs-nodemon AlmaLinux:8 | All versions | 2.0.15-1.module_el8.6.0+2904+f21ad6f4 |
nodejs-packaging AlmaLinux:8 | All versions | 25-1.module_el8.5.0+246+05401605 |
nodejs-packaging AlmaLinux:8 | All versions | 25-1.module_el8.5.0+2605+45d748af |
npm AlmaLinux:8 | All versions | 1:8.3.1-1.16.14.0.4.module_el8.6.0+2904+f21ad6f4 |
nodejs Red Hat:enterprise_linux:8::appstream | All versions | 1:16.14.0-4.module+el8.6.0+15294+54b291d2 |
nodejs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:16.14.0-4.module+el8.6.0+15294+54b291d2 |
nodejs-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 1:16.14.0-4.module+el8.6.0+15294+54b291d2 |
nodejs-devel Red Hat:enterprise_linux:8::appstream | All versions | 1:16.14.0-4.module+el8.6.0+15294+54b291d2 |
nodejs-docs Red Hat:enterprise_linux:8::appstream | All versions | 1:16.14.0-4.module+el8.6.0+15294+54b291d2 |
nodejs-full-i18n Red Hat:enterprise_linux:8::appstream | All versions | 1:16.14.0-4.module+el8.6.0+15294+54b291d2 |
nodejs-nodemon Red Hat:enterprise_linux:8::appstream | All versions | 0:2.0.15-1.module+el8.6.0+15294+54b291d2 |
nodejs-packaging Red Hat:enterprise_linux:8::appstream | All versions | 0:25-1.module+el8.5.0+10992+fac5fe06 |
npm Red Hat:enterprise_linux:8::appstream | All versions | 1:8.3.1-1.16.14.0.4.module+el8.6.0+15294+54b291d2 |
nodejs Rocky Linux:8 | All versions | 1:16.14.0-4.module+el8.6.0+978+59f26232 |
nodejs-nodemon Rocky Linux:8 | All versions | 0:2.0.15-1.module+el8.5.0+721+4c107270 |
nodejs-packaging Rocky Linux:8 | All versions | 0:25-1.module+el8.5.0+702+221f14e6 |
nodejs-packaging Rocky Linux:8 | All versions | 0:25-1.module+el8.6.0+1046+80feca58 |
Products include Fedoraproject Fedora, Netapp Next Generation Application Programming Interface, Npmjs Npm.
How do I fix CVE-2021-43616?
No fix published yet.
Is CVE-2021-43616 being exploited?
There is no known exploitation of CVE-2021-43616 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALSA-2022:4796, CLEANSTART-2026-FF52474, DEBIAN-CVE-2021-43616, GHSA-ppxp-px5q-gwqm, RHSA-2022:4796, RLSA-2022:4796 and 1 more.