CVE-2024-39698
1 advisory.
npm/electron-updater CVE-2024-39698: high 7.5, EPSS 0.43%
electron-updater Code Signing Bypass on Windows
Action: Upgrade electron-updater to 6.3.0-alpha.6 or later.
npm i electron-updater@6.3.0-alpha.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.3.0-alpha.6 | - |
Fixed versions
| 6.3.0-alpha.6 |
Sources
- osv: GHSA-9jxc-qjr9-vjxq
- https://github.com/electron-userland/electron-builder/security/advisories/GHSA-9jxc-qjr9-vjxq
- https://nvd.nist.gov/vuln/detail/CVE-2024-39698
- https://github.com/electron-userland/electron-builder/pull/8295
- https://github.com/electron-userland/electron-builder/commit/ac2e6a25aa491c1ef5167a552c19fc2085cd427f
- https://github.com/electron-userland/electron-builder
- https://github.com/electron-userland/electron-builder/blob/140e2f0eb0df79c2a46e35024e96d0563355fc89/packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts#L35-L41
CVE-2024-39698 · published · modified · JSON