PT-2023-2318 · Deno · Deno

Lucacasonato · Publicado 2023-03-23 · Atualizado 2023-03-31 · CVE-2023-28445

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Deno version 1.32.0

Description The issue is related to resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation, which could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild. Deno Deploy users are not affected.

Recommendations For Deno version 1.32.0, upgrade to Deno 1.32.1 to resolve the issue. As a temporary workaround for Deno version 1.32.0, run with --v8-flags=--no-harmony-rab-gsab to disable resizable ArrayBuffers.

Exploit

Correção

Memory Corruption

Out of bounds Read

Enumeração de Fraquezas

CWE-787

CWE-125

Identificadores relacionados

BDU:2023-02082

CVE-2023-28445

GHSA-C25X-CM9X-QQGX

Produtos afetados

Deno

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28445.json · Exploit
• https://github.com/denoland/deno · Nota
• https://github.com/denoland/deno/security/advisories/GHSA-c25x-cm9x-qqgx · Aviso do Fabricante
• https://github.com/denoland/deno/pull/18395 · Aviso do Fabricante
• https://github.com/denoland/deno/releases/tag/v1.32.1 · Correção
• https://github.com/denoland/deno/pull/18452 · Nota
• https://t.me/pentestingnews/34368 · Publicação no Telegram
• https://t.me/cibsecurity/60637 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-28445 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-c25x-cm9x-qqgx · Aviso do Fabricante
• https://t.me/cvenotify/47235 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28445 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-02082 · Nota de Segurança