GitHub Advisoryadvisory · npm

GHSA-77xc-hjv8-ww97 AutoUpdater module fails to validate certain nested components of the bundle

MEDIUM Published 2022-06-16 Modified 2022-06-29 Official page ↗
Aliases
CVE-2022-29257
Ecosystem
npm
Packages
electron
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2022-06-16

Affected packages

• npm electron: < 15.5.0 → fixed in 15.5.0 • npm electron: >= 16.0.0, < 16.2.0 → fixed in 16.2.0 • npm electron: >= 17.0.0, < 17.2.0 → fixed in 17.2.0 • npm electron: >= 18.0.0-beta.1, < 18.0.0-beta.6 → fixed in 18.0.0-beta.6

Description

Impact This vulnerability allows attackers who have control over a given apps update server / update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components. Please note that this kind of attack would require significant privileges in your own auto updating infrastructure and the ease of that attack entirely depends on your infrastructure security. Patches This has been patched and the following Electron versions contain the fix: • `18.0.0-beta.6` • `17.2.0` • `16.2.0` • `15.5.0` Workarounds There are no workarounds for this issue, please update to a patched version of Electron. For more information If you have any questions or comments about this advisory, email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2022-29257 Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References