GitHub Advisoryadvisory · npm

GHSA-34h3-8mw4-qw57 @electron/packager's build process memory potentially leaked into final executable

HIGH Published 2024-03-29 Modified 2024-03-29 Official page ↗
Aliases
CVE-2024-29900
Ecosystem
npm
Packages
@electron/packager
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-402
Reviewed
2024-03-29

Affected packages

• npm @electron/packager: >= 18.3.0, < 18.3.1 → fixed in 18.3.1

Description

Impact A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. Patches This issue is patched in 18.3.1 Workarounds No workarounds, please update to a patched version of `@electron/packager` immediately if impacated.

Related

Alias · CVE (1)

  • CVE-2024-29900 Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready… vulnerability

Weakness · CWE (1)

  • CWE-402 Transmission of Private Resources into a New Sphere weakness

References