chore(deps): update dependency electron-updater to v6 [security] #1231
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
changed the title
renovate
bot
deleted the
renovate/npm-electron-updater-vulnerability
branch
renovate
bot
changed the title
renovate
bot
restored the
renovate/npm-electron-updater-vulnerability
branch
renovate
bot
force-pushed
the
renovate/npm-electron-updater-vulnerability
branch
from
d7e8531
to
8e81d23
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^5.3.0->^6.0.0GitHub Vulnerability Alerts
CVE-2024-39698
Observations
The file
packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.tsimplements the signature validation routine for Electron applications on Windows. It executes the following command in a new shell (process.env.ComSpecon Windows, usuallyC:\Windows\System32\cmd.exe):https://github.com/electron-userland/electron-builder/blob/140e2f0eb0df79c2a46e35024e96d0563355fc89/packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts#L35-L41
Because of the surrounding shell, a first pass by
cmd.exeexpands any environment variable found in command-line above.Exploitation
This creates a situation where
verifySignature()can be tricked into validating the certificate of a different file than the one that was just downloaded. If the step is successful, the malicious update will be executed even if its signature is invalid.Impact
This attack assumes a compromised update manifest (server compromise, Man-in-the-Middle attack if fetched over HTTP, Cross-Site Scripting to point the application to a malicious updater server, etc.).
Patch
This vulnerability was patched in #8295, by comparing the path in the output of
Get-AuthenticodeSignaturewith the intended one. The patch is available starting from 6.3.0-alpha.6.Release Notes
electron-userland/electron-builder (electron-updater)
v6.3.0Compare Source
Minor Changes
53cec79bThanks @beyondkmp! - feat: adding differential downloader for updates on macOSPatch Changes
#8108
3d4cc7aeThanks @beyondkmp! - feat: addminimumSystemVersionin electron updater#8304
1ac86c9eThanks @mmaietta! - chore: update pnpm to 9.4.0#8323
fa3275c0Thanks @mmaietta! - chore(deps): update dependency typescript to v5.5.3#8135
c2392de7Thanks @mmaietta! - fix: unstable hdiutil retry mechanism#8295
ac2e6a25Thanks @mmaietta! - fix: verify LiteralPath of update file during windows signature verification#8311
35a0784eThanks @rastiqdev! - fix(rpm-updater): stop uninstalling app before update#8227
48c59535Thanks @rotu! - fix(docs): update autoupdate docs noting that channels work with Github#8110
fa7982f1Thanks @mmaietta! - chore: entering alpha release stageUpdated dependencies [
3d4cc7ae,1ac86c9e,ad668ae1,445911a7,140e2f0e,fa7982f1]:v6.2.1Compare Source
Patch Changes
e2a181d9Thanks @mmaietta! - fix(mac): revert autoupdate for mac differentialv6.2.0Compare Source
Minor Changes
79df5423Thanks @beyondkmp! - feat: adding differential downloader for updates on macOSv6.1.9Compare Source
Patch Changes
#8051
48603ba0Thanks @mmaietta! - fix: auto-update powershell script requires reset ofPSModulePath#8057
ccbb80deThanks @mmaietta! - chore: upgrading connected dependencies (typescript requires higher eslint version)Updated dependencies [
ccbb80de]:v6.1.8Compare Source
Patch Changes
03c94516Thanks @bronsonmock! - feat(nsis): add option to disable differential downloadv6.1.7Compare Source
Patch Changes
db424e8e,db424e8e]:v6.1.6Compare Source
Patch Changes
549d07b0]:v6.1.5Compare Source
Patch Changes
21f3069cThanks @jackple! - fix: When error code is ENOENT, try to use electron.shell.openPath to run installer on Windowsv6.1.4Compare Source
Patch Changes
441da40dThanks @sethjray! - fix: check null forisCustomChannelin GitHubProvider.tsv6.1.3Compare Source
Patch Changes
#7637
b3dfe64bThanks @mmaietta! - fix: triggerapp.relaunch()ifisForceRunAfter = truefor (beta) deb and rpm updaters#7633
531a6309Thanks @s00d! - fix: change typed-emitter to tiny-typed-emitter to remove rxjs dependencyv6.1.2Compare Source
Patch Changes
98f535e1Thanks @mmaietta! - fix: removing stdio from spawnSync to fix crash on rpm/deb updatersv6.1.1Compare Source
Patch Changes
cd15e161Thanks @marcuskirsch! - fix: default file name ofupdate.${fileExtension}for downloaded files in private repositories.v6.1.0Compare Source
Minor Changes
4786d415Thanks @vitto-moz! - feat: nsis install method - exposed as public to avoid quit the app for the installPatch Changes
#7544
dab3aebaThanks @NoahAndrews! - Fix differential downloads when the server compresses the blockmap file HTTP responseUpdated dependencies [
dab3aeba]:v6.0.4Compare Source
Patch Changes
9123e31eThanks @ganthern! - fix: handle errors on responses in differential download (#2398)v6.0.3Compare Source
Patch Changes
1a134800Thanks @NoahAndrews! - Fixed error handling when launching updater (fixes NSIS updates when isAdminRightsRequired is incorrectly set to false)v6.0.2Compare Source
Patch Changes
d4c90b67Thanks @NoahAndrews! - Removed DefinitelyTyped dependencies from production dependencies listv6.0.1Compare Source
Patch Changes
a2ab1ff3Thanks @mmaietta! - fix: NsisUpdater - only resolving true if pid !== undefinedv6.0.0Compare Source
Major Changes
caa32e07Thanks @kidonng! - fix: use appropriateelectron-updatercache directory on macOSMinor Changes
#7060
1d130012Thanks @mmaietta! - feat: Introducing deb and rpm auto-updates as beta feature#7337
9c0c4228Thanks @beyondkmp! - feat: Provide a custom verify function interface to enable nsis signature verification alternatives instead of powershellPatch Changes
#7380
7862e388Thanks @beyondkmp! - fix: add reject in handleError in WindowsverifySignaturefunction#7230
346af1d4Thanks @jeremyspiegel! - fix: support powershell constrained language mode#7394
1bbcfb3dThanks @ganthern! - fix: inherit stdio for updated processes (#7393)#7306
01c67910Thanks @mmaietta! - chore: Update dependencies per audit/outdated#7213
17863671Thanks @mmaietta! - chore(deps): Updating dependencies and fixingpnpm auditwith dependency overridesUpdated dependencies [
cc1ddabd,93930cf0,01c67910,53327d51]:Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.