CVE-2024-29900: @electron/packager's build process memory potentially leaked into final executable
Impact A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory could contain sensitive information such as environment variables, secrets files, etc.
Patches This issue is patched in 18.3.1
Workarounds No workarounds, please update to a patched version of @electron/packager immediately if impacated.
Other sources
Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory could contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29900?
CVE-2024-29900 is considered a medium severity vulnerability due to the potential leakage of sensitive information from memory.
How do I fix CVE-2024-29900?
To fix CVE-2024-29900, upgrade to version 18.3.1 or later of the @electron/packager package.
What kind of information could be leaked by CVE-2024-29900?
CVE-2024-29900 could leak sensitive information such as environment variables and secrets files.
What versions of @electron/packager are affected by CVE-2024-29900?
CVE-2024-29900 affects version 18.3.0 of the @electron/packager.
Is CVE-2024-29900 applicable to Node.js applications?
Yes, CVE-2024-29900 is applicable to Node.js applications utilizing the @electron/packager version 18.3.0.