high7.5
CVE-2024-29900
@electron/packager's build process memory potentially leaked into final executable
Impact
### Impact A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. ### Patches This issue is patched in 18.3.1 ### Workarounds No workarounds, please update to a patched version of `@electron/packager` immediately if impacated.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @electron/packager | = 18.3.0 | 18.3.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openjsf | Packager | Version 18.3.0 |