PT-2024-23121 · Unknown · Electron Packager

Marshallofsound · Published 2024-03-29 · Updated 2025-05-07 · CVE-2024-29900

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Electron Packager versions prior to 18.3.1

Description A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory could contain sensitive information such as environment variables, secrets files, etc.

Recommendations For versions prior to 18.3.1, update to version 18.3.1 to resolve the issue. As a temporary workaround, consider avoiding the use of sensitive information in the application source code until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-402

Related Identifiers

CVE-2024-29900

GHSA-34H3-8MW4-QW57

Affected Products

Electron Packager

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29900.json · Exploit
• https://github.com/electron/packager/commit/d421d4bd3ced889a4143c5c3ab6d95e3be249eee · Patch
• https://github.com/electron/packager/security/advisories/GHSA-34h3-8mw4-qw57 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29900 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29900 · Security Note
• https://osv.dev/vulnerability/GHSA-34h3-8mw4-qw57 · Vendor Advisory
• https://github.com/electron/packager · Note
• https://t.me/cvenotify/75136 · Telegram Post
• https://twitter.com/CVEnew/status/1773733727207674261 · Twitter Post
• https://t.me/cvenotify/121258 · Telegram Post