Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application.
This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.
Характеристики атаки
Способ атаки
По сети
Атака возможна удалённо
Сложность
Высокая
Сложно эксплуатировать
Нужны права
Не требуются
Права не нужны
Участие пользователя
Не требуется
Не нужно действие пользователя
Последствия
Конфиденциальность
Высокое
Полная утечка данных
Целостность
Высокое
Полная модификация данных
Доступность
Нет
Нет нарушения работы
Строка CVSS v3.1
Тип уязвимости (CWE)
Уязвимые продукты
electron:electron
Ссылки 13
https://github.com/electron/electron/commit/093583c71be71c85453e6e225137bf2af75…
security-advisories@github.com
https://github.com/electron/electron/commit/1d2f13b1985444a38abf389db38228ac42f…
security-advisories@github.com
https://github.com/electron/electron/commit/817c43f925677eb88034bfba4f0b8dfd28e…
security-advisories@github.com
https://github.com/electron/electron/commit/e02265be96c5e13ae43644ef482b718e1e8…
security-advisories@github.com
https://github.com/electron/electron/pull/55127
security-advisories@github.com
https://github.com/electron/electron/pull/55128
security-advisories@github.com
https://github.com/electron/electron/pull/55129
security-advisories@github.com
https://github.com/electron/electron/pull/55130
security-advisories@github.com
https://github.com/electron/electron/releases/tag/v42.11.16
security-advisories@github.com
https://github.com/electron/electron/releases/tag/v43.8.1
security-advisories@github.com
https://github.com/electron/electron/releases/tag/v44.9.1
security-advisories@github.com
https://github.com/electron/electron/releases/tag/v45.0.0-beta.6
security-advisories@github.com
https://github.com/electron/electron/security/advisories/GHSA-jr5w-w6x2-84p9
security-advisories@github.com