Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0. Deno Deploy users are not affected. The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. Deno 1.32.2 will re-enable resizable ArrayBuffers with a proper fix. As a workaround, run with `--v8-flags=--no-harmony-rab-gsab` to disable resizable ArrayBuffers.
References
| Link | Resource |
|---|---|
| https://github.com/denoland/deno/pull/18395 | Patch Vendor Advisory |
| https://github.com/denoland/deno/releases/tag/v1.32.1 | Patch Release Notes |
| https://github.com/denoland/deno/security/advisories/GHSA-c25x-cm9x-qqgx | Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
31 Mar 2023, 13:07
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/denoland/deno/security/advisories/GHSA-c25x-cm9x-qqgx - Mitigation, Vendor Advisory | |
| References | (MISC) https://github.com/denoland/deno/releases/tag/v1.32.1 - Patch, Release Notes | |
| References | (MISC) https://github.com/denoland/deno/pull/18395 - Patch, Vendor Advisory | |
| First Time |
Deno deno
Deno deno Runtime Deno Deno serde V8 |
|
| CPE | cpe:2.3:a:deno:serde_v8:0.87.0:*:*:*:*:rust:*:* cpe:2.3:a:deno:deno:1.32.0:*:*:*:*:*:*:* cpe:2.3:a:deno:deno_runtime:0.102.0:*:*:*:*:rust:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
24 Mar 2023, 01:57
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-24 00:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-28445
Mitre link : CVE-2023-28445
CVE.ORG link : CVE-2023-28445
JSON object : View
Products Affected
deno
- serde_v8
- deno
- deno_runtime