chore: bump up vm2 version [SECURITY] #440
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
perfseeBundle maindiff ------------------- Bundle Size Diff -------------------------
@@ EntryPoint: main @@
## main …vulnerability +/- ##
===================================================================
= Bundle 3.31 MB 3.31 MB
= Initial JS 1.12 MB 1.12 MB
= Initial CSS 0 B 0 B
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
= Assets 79 79
= Chunks 78 78
= Packages 81 81
= Duplicates 0 0
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #440 +/- ##
==========================================
- Coverage 78.76% 78.75% -0.02%
==========================================
Files 409 409
Lines 38248 38248
Branches 2306 2306
==========================================
- Hits 30126 30122 -4
- Misses 7920 7924 +4
Partials 202 202 ☔ View full report in Codecov by Sentry. |
renovate
bot
force-pushed
the
renovate/npm-vm2-vulnerability
branch
2 times, most recently
from
40755b6
to
614d1fb
Compare
renovate
bot
force-pushed
the
renovate/npm-vm2-vulnerability
branch
from
614d1fb
to
2c54eb2
Compare
renovate
bot
force-pushed
the
renovate/npm-vm2-vulnerability
branch
2 times, most recently
from
5b1d7f9
to
402c439
Compare
renovate
bot
force-pushed
the
renovate/npm-vm2-vulnerability
branch
from
402c439
to
9a43a2c
Compare
renovate
bot
force-pushed
the
renovate/npm-vm2-vulnerability
branch
2 times, most recently
from
d5a2b66
to
1d3cce7
Compare
renovate
bot
force-pushed
the
renovate/npm-vm2-vulnerability
branch
from
1d3cce7
to
db0fe92
Compare
renovate
bot
force-pushed
the
renovate/npm-vm2-vulnerability
branch
from
db0fe92
to
c5d6655
Compare
renovate
bot
force-pushed
the
renovate/npm-vm2-vulnerability
branch
from
c5d6655
to
9b0ef68
Compare
renovate
bot
force-pushed
the
renovate/npm-vm2-vulnerability
branch
from
9b0ef68
to
f9c1e7b
Compare
renovate
bot
force-pushed
the
renovate/npm-vm2-vulnerability
branch
from
f9c1e7b
to
641eaa9
Compare
⚠ Artifact update problemRenovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below: File name: yarn.lock |
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.9.16->3.9.183.9.14->3.9.16Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2023-30547
There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside
handleException()which can be used to escape the sandbox and run arbitrary code in host context.Impact
A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.
Patches
This vulnerability was patched in the release of version
3.9.17ofvm2.Workarounds
None.
References
PoC - https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244
For more information
If you have any questions or comments about this advisory:
Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.
CVE-2023-32314
A sandbox escape vulnerability exists in vm2 for versions up to 3.9.17. It abuses an unexpected creation of a host object based on the specification of
Proxy.Impact
A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.
Patches
This vulnerability was patched in the release of version
3.9.18ofvm2.Workarounds
None.
References
PoC - https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac
For more information
If you have any questions or comments about this advisory:
Thanks to @arkark (Takeshi Kaneko) of GMO Cybersecurity by Ierae, Inc. for disclosing this vulnerability.
CVE-2023-32313
In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node
inspectmethod and edit options forconsole.log.Impact
A threat actor can edit options for
console.log.Patches
This vulnerability was patched in the release of version
3.9.18ofvm2.Workarounds
After creating a vm make the
inspectmethod readonly withvm.readonly(inspect).References
PoC - https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550
For more information
If you have any questions or comments about this advisory:
Thanks to @arkark (Takeshi Kaneko) of GMO Cybersecurity by Ierae, Inc. for disclosing this vulnerability.
CVE-2023-29017
vm2 was not properly handling host objects passed to
Error.prepareStackTracein case of unhandled async errors.Impact
A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.
Patches
This vulnerability was patched in the release of version
3.9.15ofvm2.Workarounds
None.
CVE-2023-29199
There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass
handleException()and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context.Impact
A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.
Patches
This vulnerability was patched in the release of version
3.9.16ofvm2.Workarounds
None.
References
Github Issue - https://github.com/patriksimek/vm2/issues/516
PoC - https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c
For more information
If you have any questions or comments about this advisory:
Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.
Release Notes
patriksimek/vm2 (vm2)
v3.9.18Compare Source
[fix] Multiple security fixes.
[new] Add resolver API to create a shared resolver for multiple
NodeVMinstances allowing to cache scripts and increase sandbox startup times.[new] Allow to pass a function to
require.contextwhich is called with the filename allowing to specify the context pre file.v3.9.17Compare Source
[fix] Multiple security fixes.
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate. View repository job log here.