CVE-2022-29244

🗓️ 13 Jun 2022 13:40:27Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 171 Views

npm pack ignores root-level .gitignore and .npmignore file exclusion directive

Reporter	Title	Published	Views	Family All 75
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to loss of confidentiality due to CVE-2022-29244	4 Nov 202218:15	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities in moment, ansi-regex, Node.js, and minimatch may affect IBM Spectrum Protect Client and IBM Spectrum Protect for Space Management (CVE-2022-31129, CVE-2022-24785, CVE-2021-3807, CVE-2022-29244, CVE-2022-3517)	17 Mar 202309:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities	4 Apr 202318:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in Node.js	17 May 202320:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	7 Jun 202316:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js npm module information disclosure (CVE-2022-29244)	19 Apr 202321:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities	20 Jun 202304:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	12 Jan 202317:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote authenticated attacker due to Node.js (CVE-2022-29244, CVE-2022-33987)	14 Nov 202214:14	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities in moment, ansi-regex, Node.js, and minimatch may affect IBM Spectrum Protect Plus Microsoft File Systems Backup and Restore (CVE-2022-31129, CVE-2022-24785, CVE-2021-3807, CVE-2022-29244, CVE-2022-3517)	16 Mar 202307:57	–	ibm

NVD

Vulners

Node

npmjs npmRange7.9.0–8.11.0

Node

netapp ontap_select_deploy_administration_utilityMatch-

[
  {
    "product": "npm",
    "vendor": "npm",
    "versions": [
      {
        "lessThan": "7.9.0*",
        "status": "affected",
        "version": "7.9.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.11.0",
        "status": "affected",
        "version": "8.11.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/nodejs/node/releases/tag/v16.15.1
github	www.github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52
security	www.security.netapp.com/advisory/ntap-20220722-0007/
github	www.github.com/npm/cli/tree/latest/workspaces/libnpmpublish
github	www.github.com/npm/cli/tree/latest/workspaces/libnpmpack
github	www.github.com/npm/npm-packlist
github	www.github.com/npm/cli/releases/tag/v8.11.0
github	www.github.com/nodejs/node/pull/43210
github	www.github.com/nodejs/node/releases/tag/v17.9.1
github	www.github.com/nodejs/node/releases/tag/v18.3.0

23 Apr 2025 17:15Current

8.4High risk

Vulners AI Score8.4

CVSS 25

CVSS 3.17.5

EPSS0.0085

SSVC

CWE-200