CVE - CVE-2024-29900

CVE-ID
CVE-2024-29900	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/electron/packager/commit/d421d4bd3ced889a4143c5c3ab6d95e3be249eee URL:https://github.com/electron/packager/commit/d421d4bd3ced889a4143c5c3ab6d95e3be249eee MISC:https://github.com/electron/packager/security/advisories/GHSA-34h3-8mw4-qw57 URL:https://github.com/electron/packager/security/advisories/GHSA-34h3-8mw4-qw57
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20240321	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240321)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)