Lucene search
Veracode Vulnerability DatabaseVERACODE:35847HistoryJun 03, 2022 - 5:40 a.m.
Supply Chain Attack
2022-06-0305:40:41
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
16
npm
supply chain
attack
vulnerability
software
verification
workspace path
EPSS
0.002
Percentile
58.3%
npm is vulnerable to supply chain attack. The vulnerability exists due to the lack of verification root-level workspace path.
References
github.com/advisories/GHSA-hj9c-8jmm-8c52
github.com/nodejs/node/pull/43210
github.com/nodejs/node/releases/tag/v16.15.1
github.com/nodejs/node/releases/tag/v17.9.1
github.com/nodejs/node/releases/tag/v18.3.0
github.com/npm/cli/releases/tag/v8.11.0
github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52
github.com/npm/cli/tree/latest/workspaces/libnpmpack
github.com/npm/cli/tree/latest/workspaces/libnpmpublish
github.com/npm/npm-packlist
security.netapp.com/advisory/ntap-20220722-0007/
Related
prion
prion
Code injection
2022-06-13 14:15:00
ibm
ibm
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js npm module information disclosure (CVE-2022-29244)
2023-04-19 21:24:57
ubuntucve
ubuntucve
CVE-2022-29244
2022-06-13 00:00:00
osv
osv
Packing does not respect root-level ignore files in workspaces
2022-06-02 15:37:27
corepack16-16.17.0-1.1 on GA media
2024-06-15 00:00:00
CVE-2022-29244
2022-06-13 14:15:09
alpinelinux
alpinelinux
CVE-2022-29244
2022-06-13 14:15:00
cvelist
cvelist
github
github
Packing does not respect root-level ignore files in workspaces
2022-06-02 15:37:27
nvd
nvd
CVE-2022-29244
2022-06-13 14:15:09
redhatcve
redhatcve
CVE-2022-29244
2022-06-20 05:59:52
cve
cve
CVE-2022-29244
2022-06-13 14:15:09
redos
redos
ROS-20230616-01
2023-06-16 00:00:00
openvas
openvas
openSUSE: Security Advisory for nodejs16 (SUSE-SU-2022:3250-1)
2022-09-13 00:00:00
openSUSE: Security Advisory for nodejs16 (SUSE-SU-2022:3251-1)
2022-09-13 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:3196-1)
2022-09-09 00:00:00
nessus
nessus
SUSE SLES12 Security Update : nodejs16 (SUSE-SU-2022:3196-1)
2022-09-09 00:00:00
SUSE SLES15 Security Update : nodejs16 (SUSE-SU-2022:3250-1)
2022-09-13 00:00:00
SUSE SLES15 Security Update : nodejs16 (SUSE-SU-2022:3251-1)
2022-09-13 00:00:00
suse
suse
Security update for nodejs16 (moderate)
2022-09-12 00:00:00
Security update for nodejs16 (moderate)
2022-09-12 00:00:00
rocky
rocky
nodejs and nodejs-nodemon security and bug fix update
2022-09-20 11:37:49
oraclelinux
oraclelinux
nodejs and nodejs-nodemon security and bug fix update
2022-09-22 00:00:00
redhat
redhat
almalinux
almalinux
Moderate: nodejs and nodejs-nodemon security and bug fix update
2022-09-20 00:00:00