GitHub Advisoryadvisory · crates.io

GHSA-vc52-gwm3-8v2f Missing "--allow-net" permission check for built-in Node modules

HIGH Published 2023-05-31 Modified 2023-05-31 Official page ↗
Aliases
CVE-2023-33966
Ecosystem
crates.io
Packages
deno, deno_runtime
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-269, CWE-276
Reviewed
2023-05-31

Affected packages

• crates.io deno: >= 1.34.0, < 1.34.1 → fixed in 1.34.1 • crates.io deno_runtime: >= 0.114.0, < 0.115.0 → fixed in 0.115.0

Description

Impact Outbound HTTP requests made using the built-in "node:http" or "node:https" modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. Patches This problem has been patched in Deno v1.34.1 and all users are recommended to update to this version. Workarounds No workaround is available for this issue.

Related

Alias · CVE (1)

  • CVE-2023-33966 Deno is a runtime for JavaScript and TypeScript. vulnerability

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-276 Incorrect Default Permissions weakness

References