GHSA-c25x-cm9x-qqgx

Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-c25x-cm9x-qqgx/GHSA-c25x-cm9x-qqgx.json

Aliases

• CVE-2023-28445

Published

2023-03-23T23:13:25Z

Modified

2023-05-01T21:25:28Z

Details

Impact

Resizable ArrayBuffers passed to asynchronous native functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write.

It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0.

Deno Deploy users are not affected.

Patches

The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. A future version of Deno will re-enable resizable ArrayBuffers with a proper fix.

Workarounds

Upgrade to Deno 1.32.1, or run with --v8-flags=--no-harmony-rab-gsab to disable resizable ArrayBuffers.

References

• https://github.com/denoland/deno/security/advisories/GHSA-c25x-cm9x-qqgx
• https://nvd.nist.gov/vuln/detail/CVE-2023-28445
• https://github.com/denoland/deno/pull/18395
• https://github.com/denoland/deno/pull/18452
• https://github.com/denoland/deno
• https://github.com/denoland/deno/releases/tag/v1.32.1