Update dependency electron-updater to v6 [SECURITY] - #271
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.3.4→6.3.0electron-updater Code Signing Bypass on Windows
CVE-2024-39698 / GHSA-9jxc-qjr9-vjxq
More information
Details
Observations
The file
packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.tsimplements the signature validation routine for Electron applications on Windows. It executes the following command in a new shell (process.env.ComSpecon Windows, usuallyC:\Windows\System32\cmd.exe):https://github.com/electron-userland/electron-builder/blob/140e2f0eb0df79c2a46e35024e96d0563355fc89/packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts#L35-L41
Because of the surrounding shell, a first pass by
cmd.exeexpands any environment variable found in command-line above.Exploitation
This creates a situation where
verifySignature()can be tricked into validating the certificate of a different file than the one that was just downloaded. If the step is successful, the malicious update will be executed even if its signature is invalid.Impact
This attack assumes a compromised update manifest (server compromise, Man-in-the-Middle attack if fetched over HTTP, Cross-Site Scripting to point the application to a malicious updater server, etc.).
Patch
This vulnerability was patched in #8295, by comparing the path in the output of
Get-AuthenticodeSignaturewith the intended one. The patch is available starting from 6.3.0-alpha.6.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
electron-userland/electron-builder (electron-updater)
v6.3.0Compare Source
Minor Changes
53cec79bThanks @beyondkmp! - feat: adding differential downloader for updates on macOSPatch Changes
#8108
3d4cc7aeThanks @beyondkmp! - feat: addminimumSystemVersionin electron updater#8304
1ac86c9eThanks @mmaietta! - chore: update pnpm to 9.4.0#8323
fa3275c0Thanks @mmaietta! - chore(deps): update dependency typescript to v5.5.3#8135
c2392de7Thanks @mmaietta! - fix: unstable hdiutil retry mechanism#8295
ac2e6a25Thanks @mmaietta! - fix: verify LiteralPath of update file during windows signature verification#8311
35a0784eThanks @rastiqdev! - fix(rpm-updater): stop uninstalling app before update#8227
48c59535Thanks @rotu! - fix(docs): update autoupdate docs noting that channels work with Github#8110
fa7982f1Thanks @mmaietta! - chore: entering alpha release stageUpdated dependencies [
3d4cc7ae,1ac86c9e,ad668ae1,445911a7,140e2f0e,fa7982f1]:v6.2.1Compare Source
Patch Changes
e2a181d9Thanks @mmaietta! - fix(mac): revert autoupdate for mac differentialv6.2.0Compare Source
Minor Changes
79df5423Thanks @beyondkmp! - feat: adding differential downloader for updates on macOSv6.1.9Compare Source
Patch Changes
#8051
48603ba0Thanks @mmaietta! - fix: auto-update powershell script requires reset ofPSModulePath#8057
ccbb80deThanks @mmaietta! - chore: upgrading connected dependencies (typescript requires higher eslint version)Updated dependencies [
ccbb80de]:v6.1.8Compare Source
Patch Changes
03c94516Thanks @bronsonmock! - feat(nsis): add option to disable differential downloadv6.1.7Compare Source
Patch Changes
db424e8e,db424e8e]:v6.1.6Compare Source
Patch Changes
549d07b0]:v6.1.5Compare Source
Patch Changes
21f3069cThanks @jackple! - fix: When error code is ENOENT, try to use electron.shell.openPath to run installer on Windowsv6.1.4Compare Source
Patch Changes
441da40dThanks @sethjray! - fix: check null forisCustomChannelin GitHubProvider.tsv6.1.3Compare Source
Patch Changes
#7637
b3dfe64bThanks @mmaietta! - fix: triggerapp.relaunch()ifisForceRunAfter = truefor (beta) deb and rpm updaters#7633
531a6309Thanks @s00d! - fix: change typed-emitter to tiny-typed-emitter to remove rxjs dependencyv6.1.2Compare Source
Patch Changes
98f535e1Thanks @mmaietta! - fix: removing stdio from spawnSync to fix crash on rpm/deb updatersv6.1.1Compare Source
Patch Changes
cd15e161Thanks @marcuskirsch! - fix: default file name ofupdate.${fileExtension}for downloaded files in private repositories.v6.1.0Compare Source
Minor Changes
4786d415Thanks @vitto-moz! - feat: nsis install method - exposed as public to avoid quit the app for the installPatch Changes
#7544
dab3aebaThanks @NoahAndrews! - Fix differential downloads when the server compresses the blockmap file HTTP responseUpdated dependencies [
dab3aeba]:v6.0.4Compare Source
Patch Changes
9123e31eThanks @ganthern! - fix: handle errors on responses in differential download (#2398)v6.0.3Compare Source
Patch Changes
1a134800Thanks @NoahAndrews! - Fixed error handling when launching updater (fixes NSIS updates when isAdminRightsRequired is incorrectly set to false)v6.0.2Compare Source
Patch Changes
d4c90b67Thanks @NoahAndrews! - Removed DefinitelyTyped dependencies from production dependencies listv6.0.1Compare Source
Patch Changes
a2ab1ff3Thanks @mmaietta! - fix: NsisUpdater - only resolving true if pid !== undefinedv6.0.0Compare Source
Major Changes
caa32e07Thanks @kidonng! - fix: use appropriateelectron-updatercache directory on macOSMinor Changes
#7060
1d130012Thanks @mmaietta! - feat: Introducing deb and rpm auto-updates as beta feature#7337
9c0c4228Thanks @beyondkmp! - feat: Provide a custom verify function interface to enable nsis signature verification alternatives instead of powershellPatch Changes
#7380
7862e388Thanks @beyondkmp! - fix: add reject in handleError in WindowsverifySignaturefunction#7230
346af1d4Thanks @jeremyspiegel! - fix: support powershell constrained language mode#7394
1bbcfb3dThanks @ganthern! - fix: inherit stdio for updated processes (#7393)#7306
01c67910Thanks @mmaietta! - chore: Update dependencies per audit/outdated#7213
17863671Thanks @mmaietta! - chore(deps): Updating dependencies and fixingpnpm auditwith dependency overridesUpdated dependencies [
cc1ddabd,93930cf0,01c67910,53327d51]:v5.3.0Compare Source
Minor Changes
4d989a8aThanks @shenglianlee! - feat: non-silent mode allow not to run the app when the installation is completev5.2.4Compare Source
Patch Changes
0c528411Thanks @mmaietta! - feat: allow dev update config to be forced for testing auto-updater flowv5.2.3Compare Source
Patch Changes
#7099
cd21b091Thanks @alefoll! - fix(docs): improvedownloadUpdatetyping to match the docUpdated dependencies [
1023a93e]:v5.2.2Compare Source
Patch Changes
e7179b57]:v5.2.1Compare Source
Patch Changes
d6115bc5Thanks @matejkriz! - fix(electron-updater): fix backward compatibility for GitHub provider without channelsc9f0da51Thanks @panther7! - Fix installDir definition #6907v5.2.0Compare Source
Minor Changes
e7f28677Thanks @panther7! - Add installDir property for NsisUpdater. Now is it posible change install folder from AppUpdater.v5.1.0Compare Source
Minor Changes
14503cebThanks @ezekg! - Upgrade Keygen publisher/updater integration to API version v1.1.Patch Changes
#6975
8279d053Thanks @ezekg! - Fix artifact conflicts for Keygen provider when multiple artifacts share the same filename across products.Updated dependencies [
adeaa347]:v5.0.6Compare Source
Patch Changes
0b6db59eThanks @ezekg! - Pin Keygen publisher/updater integration to API version v1.0.v5.0.5Compare Source
Patch Changes
869ec27fThanks @mmaietta! - fix: moving typed-emitter from devDependency to dependenciesv5.0.4Compare Source
Patch Changes
bfe29a5eThanks @RoikkuTo! - fix: Unable to find latest version on GitHubdb075480Thanks @Nokel81! - Added types for AppUpdater's eventsv5.0.3Compare Source
Patch Changes
#6810
817e68baThanks @blakebyrnes! - fix: github provider prerelease check incorrectly casts undefined to String. Resolves #6809Updated dependencies [
7af4c226]:v5.0.2Compare Source
Patch Changes
9a7ed436- chore: updating dependency treeUpdated dependencies [
9a7ed436]:v5.0.1Compare Source
Patch Changes
27f18aa1Thanks @YanDevDe! - fix: Updater "Error: Could not connect to the server." in macOS. Don't close server directly at quitAndInstall #6743v5.0.0Compare Source
Major Changes
#6556
a138a86fThanks @mmaietta! - Breaking changesRemoving Bintray support since it was sunset. Ref: https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-chartcenter/
Fail-fast for windows signature verification failures. Adding
-LiteralPathto update file path to disregard injected wildcardsForce strip path separators for backslashes on Windows during update process
Force authentication for local mac squirrel update server
Fixes:
fix(nsis): Adding --INPUTCHARSET to makensis. (#4898 #6232 #6259)
Adding additional details to error console logging
5e381c55Thanks @devinbinnie! - fix: Allow disabling of webinstaller files to avoid confusion with actual installers53467c72Thanks @devinbinnie! - fix: Update certificate validation on Windows to check full DNMinor Changes
1de0adbdThanks @KenCorma! - feat(updater): Add Channel Support for Github with PreReleasePatch Changes
edc4b030Thanks @mmaietta! - fix(updater): Replacing fs/promises with fs-extra to support legacy versions of Electron that use node 12 and below. Fixes: #60008746f910Thanks @devinbinnie! - fix: fixes for server auth for MacUpdater633ee5dcThanks @devinbinnie! - - Removed backtick escaping for Windows code signing as it is unnecessary for Powershell and can cause the script to attempt to access the wrong file#6616
86e6d150Thanks @mmaietta! - fix(updater): Remove checks for app-update.yml when auto-updates are not supportedUpdated dependencies [
a138a86f]:v4.6.5Patch Changes
828fcd37Thanks @zhanjinfeng! - fix: useuname -ato get arch instead of 'process.arch' in mac siliconv4.6.4Patch Changes
661a6522Thanks @robertpatrick! - fix(nsis): fix per-machine installs to properly elevate during silent install/updatesv4.6.3Patch Changes
3c38af42Thanks @Nokel81! - Emulate electron.autoUpdater's event lifecycle for AppImageUpdaterv4.6.2Patch Changes
#6390
a5e8073eThanks @Nokel81! - Fix updating only on demand not working on macOSUpdated dependencies [
66ca625f]:v4.6.1Patch Changes
54ee4e72]:v4.6.0Minor Changes
a9453216Thanks @mmaietta! - feat: adding Bitbucket publisher and autoupdaterPatch Changes
a9453216]:v4.5.2Patch Changes
0c21cd69Thanks @johnnyopao! - Fix upgrade flows on intel mac when both x64 and arm64 versions publishedv4.5.1Patch Changes
7f933d00]:v4.5.0Minor Changes
f45110cbThanks @mmaietta! - feat: Adding Keygen as an official publisher/updater for electron-builder (#6167)Patch Changes
f45110cb]:v4.4.6Patch Changes
a3c72b2: fix(electron-updater): workaround vite's process.env.* replacementca0e845: fix(electron-updater):nullobject error when MacUpdater attempts to log the server port before it is listeningv4.4.5Patch Changes
a3f2cd1: fix(electron-updater): default import throws error for fs and path leading to always requiring elevationae363e5: fix: removing data from error being thrown. It's unnecessary and also unnecessarily large to be passing to the console. Resolves: #6131v4.4.4Patch Changes
ae81dfa: fix(electron-updater): small cleanup and add more debug logging for MacUpdater to investigate #6120v4.4.3Patch Changes
a4eae34: Synchronizing CLI and package.json versions. Updating auto-publish values + changeset generation to be more frictionlessa4eae34]v4.4.2Patch Changes
878671d: Updating patch number as many deps were updated as parted of RenovateBot integration878671d]v4.4.1Patch Changes
1272afc: Initial introduction of changset config1272afc]Bug Fixes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.