CVE-2023-28445

2023-03-2400:15:15

CWE-787

CWE-125

[email protected]

web.nvd.nist.gov

deno

javascript

typescript

rust

arraybuffer

security

vulnerability

cve

nvd

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.9%

JSON

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0. Deno Deploy users are not affected. The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. Deno 1.32.2 will re-enable resizable ArrayBuffers with a proper fix. As a workaround, run with --v8-flags=--no-harmony-rab-gsab to disable resizable ArrayBuffers.

Affected configurations

Vulners

NVD

Node

denolanddenoMatch1.32.0

CPENameOperatorVersion
deno:denodenoeq1.32.0
deno:deno_runtimedeno deno runtimeeq0.102.0
deno:serde_v8deno serde v8eq0.87.0

CPE	Name	Operator	Version
deno:deno	deno	eq	1.32.0
deno:deno_runtime	deno deno runtime	eq	0.102.0
deno:serde_v8	deno serde v8	eq	0.87.0

CNA Affected

[
  {
    "vendor": "denoland",
    "product": "deno",
    "versions": [
      {
        "version": "= 1.32.0",
        "status": "affected"
      }
    ]
  }
]