fix(deps): update dependency electron-updater to v6.3.0 [security] #8023
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![live-github-bot[bot]](https://avatars.githubusercontent.com/in/198164?s=60&v=4){kind=small}
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎ 5 Skipped Deployments
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
6.1.8->6.3.0GitHub Vulnerability Alerts
CVE-2024-39698
Observations
The file
packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.tsimplements the signature validation routine for Electron applications on Windows. It executes the following command in a new shell (process.env.ComSpecon Windows, usuallyC:\Windows\System32\cmd.exe):https://github.com/electron-userland/electron-builder/blob/140e2f0eb0df79c2a46e35024e96d0563355fc89/packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts#L35-L41
Because of the surrounding shell, a first pass by
cmd.exeexpands any environment variable found in command-line above.Exploitation
This creates a situation where
verifySignature()can be tricked into validating the certificate of a different file than the one that was just downloaded. If the step is successful, the malicious update will be executed even if its signature is invalid.Impact
This attack assumes a compromised update manifest (server compromise, Man-in-the-Middle attack if fetched over HTTP, Cross-Site Scripting to point the application to a malicious updater server, etc.).
Patch
This vulnerability was patched in #8295, by comparing the path in the output of
Get-AuthenticodeSignaturewith the intended one. The patch is available starting from 6.3.0-alpha.6.Release Notes
electron-userland/electron-builder (electron-updater)
v6.3.0Compare Source
Minor Changes
53cec79bThanks @beyondkmp! - feat: adding differential downloader for updates on macOSPatch Changes
#8108
3d4cc7aeThanks @beyondkmp! - feat: addminimumSystemVersionin electron updater#8304
1ac86c9eThanks @mmaietta! - chore: update pnpm to 9.4.0#8323
fa3275c0Thanks @mmaietta! - chore(deps): update dependency typescript to v5.5.3#8135
c2392de7Thanks @mmaietta! - fix: unstable hdiutil retry mechanism#8295
ac2e6a25Thanks @mmaietta! - fix: verify LiteralPath of update file during windows signature verification#8311
35a0784eThanks @rastiqdev! - fix(rpm-updater): stop uninstalling app before update#8227
48c59535Thanks @rotu! - fix(docs): update autoupdate docs noting that channels work with Github#8110
fa7982f1Thanks @mmaietta! - chore: entering alpha release stageUpdated dependencies [
3d4cc7ae,1ac86c9e,ad668ae1,445911a7,140e2f0e,fa7982f1]:v6.2.1Compare Source
Patch Changes
e2a181d9Thanks @mmaietta! - fix(mac): revert autoupdate for mac differentialv6.2.0Compare Source
Minor Changes
79df5423Thanks @beyondkmp! - feat: adding differential downloader for updates on macOSv6.1.9Compare Source
Patch Changes
#8051
48603ba0Thanks @mmaietta! - fix: auto-update powershell script requires reset ofPSModulePath#8057
ccbb80deThanks @mmaietta! - chore: upgrading connected dependencies (typescript requires higher eslint version)Updated dependencies [
ccbb80de]:Configuration
📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.