@electron/packager's build process memory potentially leaked into final executable

高 7.5CVE-2024-29900 · GHSA-34h3-8mw4-qw57 · 29/03/2024 公開 · 17/06/2026 更新

要点

CVE-2024-29900 は packager (openjsf), @electron/packager に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.63%（全脆弱性の 50.3% より高い）。
対処：18.3.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
packager openjsf	`= 18.3.0`	修正版なし
@electron/packager npm	`≥ 18.3.0, < 18.3.1`	`18.3.1`

概要

Impact

A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory could contain sensitive information such as environment variables, secrets files, etc.

Patches

This issue is patched in 18.3.1

Workarounds

No workarounds, please update to a patched version of @electron/packager immediately if impacated.

NVD の説明

Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.