GHSA-34h3-8mw4-qw57: @electron/packager's build process memory potentially leaked into final executable

Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

Sign up

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2024-29900

@electron/packager’s build process memory potentially leaked into final executable

High severity GitHub Reviewed Published Mar 28, 2024 in electron/packager • Updated Mar 29, 2024

Package

npm @electron/packager (npm)

Affected versions

= 18.3.0

Description

Impact

A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory could contain sensitive information such as environment variables, secrets files, etc.

Patches

This issue is patched in 18.3.1

Workarounds

No workarounds, please update to a patched version of @electron/packager immediately if impacated.

References

• GHSA-34h3-8mw4-qw57
• https://nvd.nist.gov/vuln/detail/CVE-2024-29900
• electron/packager@d421d4b

Published to the GitHub Advisory Database

Mar 29, 2024

Last updated

Mar 29, 2024