{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47829", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-10-03T14:06:12.642Z", "datePublished": "2025-04-23T15:42:12.623Z", "dateUpdated": "2025-04-23T16:08:45.843Z"}, "containers": {"cna": {"title": "pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting", "problemTypes": [{"descriptions": [{"cweId": "CWE-328", "lang": "en", "description": "CWE-328: Use of Weak Hash", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/pnpm/pnpm/security/advisories/GHSA-8cc4-rfj6-fhg4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-8cc4-rfj6-fhg4"}], "affected": [{"vendor": "pnpm", "product": "pnpm", "versions": [{"version": "< 10.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-04-23T15:42:12.623Z"}, "descriptions": [{"lang": "en", "value": "pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same storage path for two different libraries. Although the real names are under the package name /node_modoules/, there are no version numbers for the libraries they refer to. This issue has been patched in version 10.0.0."}], "source": {"advisory": "GHSA-8cc4-rfj6-fhg4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T16:07:35.550538Z", "id": "CVE-2024-47829", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T16:08:45.843Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47829", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-23T16:07:35.550538Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T16:08:32.391Z"}}], "cna": {"title": "pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting", "source": {"advisory": "GHSA-8cc4-rfj6-fhg4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "pnpm", "product": "pnpm", "versions": [{"status": "affected", "version": "< 10.0.0"}]}], "references": [{"url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-8cc4-rfj6-fhg4", "name": "https://github.com/pnpm/pnpm/security/advisories/GHSA-8cc4-rfj6-fhg4", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same storage path for two different libraries. Although the real names are under the package name /node_modoules/, there are no version numbers for the libraries they refer to. This issue has been patched in version 10.0.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-328", "description": "CWE-328: Use of Weak Hash"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-04-23T15:42:12.623Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47829", "state": "PUBLISHED", "dateUpdated": "2025-04-23T16:08:45.843Z", "dateReserved": "2024-10-03T14:06:12.642Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-04-23T15:42:12.623Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:*:node.js:*", "matchCriteriaId": "89AB81FD-3362-4C6A-AB71-9996BB1C31C2", "versionEndExcluding": "10.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same storage path for two different libraries. Although the real names are under the package name /node_modoules/, there are no version numbers for the libraries they refer to. This issue has been patched in version 10.0.0."}, {"lang": "es", "value": "pnpm es un gestor de paquetes. Antes de la versi\u00f3n 10.0.0, la funci\u00f3n de acortamiento de rutas utilizaba la funci\u00f3n md5 como funci\u00f3n de compresi\u00f3n de acortamiento de rutas, y si se produc\u00eda una colisi\u00f3n, se obten\u00eda la misma ruta de almacenamiento para dos librer\u00edas diferentes. Aunque los nombres reales se encuentran bajo el nombre del paquete /node_modoules/, no hay n\u00fameros de versi\u00f3n para las librer\u00edas a las que hacen referencia. Este problema se ha corregido en la versi\u00f3n 10.0.0."}], "id": "CVE-2024-47829", "lastModified": "2025-09-19T20:08:55.927", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.7, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "[email protected]", "type": "Primary"}]}, "published": "2025-04-23T16:15:29.910", "references": [{"source": "[email protected]", "tags": ["Vendor Advisory", "Exploit"], "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-8cc4-rfj6-fhg4"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-328"}], "source": "[email protected]", "type": "Primary"}]}

{"bugzilla": {"description": "pnpm: pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting", "id": "2361884", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361884"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-328", "details": ["pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same storage path for two different libraries. Although the real names are under the package name /node_modoules/, there are no version numbers for the libraries they refer to. This issue has been patched in version 10.0.0.", "A flaw was found in the pnpm package manager. In the affected versions, the path shortening function utilizes the MD5 hashing algorithm for compressing paths. If a collision occurs, this can lead to two different libraries being stored in the same path. Although the real names of these libraries are stored under the package name in the /node_modules/ directory, the version numbers for the libraries are not included."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-47829", "package_state": [{"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "org.keycloak-keycloak-parent", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "org.keycloak-keycloak-parent", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}], "public_date": "2025-04-23T15:42:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-47829\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-47829\nhttps://github.com/pnpm/pnpm/security/advisories/GHSA-8cc4-rfj6-fhg4"], "threat_severity": "Moderate"}