@glow-app/glow-react (>=0.6.0, <=1.0.1), @glow-app/solana-client (>=0.5.2, <=1.0.4) +17 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.44.0, <=1.44.2)

@solana/web3.js NPM version =1.44.0, =0.6.0, =0.5.2, =1.1.0, =0.1.0, =1.0.5, =4.1.2, =4.1.3, =4.1.3, =0.1.20-beta-1, =0.2.40, =3.2.0, =0.0.50, =0.1.0, =0.1.2 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@fabric-foundation/sdk (>=0.0.2, <=0.0.64), @zetamarkets/flex-sdk (0.1.0) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.18.0)

@solana/web3.js NPM version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @fabric-foundation/sdk =0.0.2, =0.6.15, =0.9.9 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@altruism-finance/js (>=0.1.0, <=0.1.1), @sh-coins/solana (>=0.3.0, <=0.3.8) potentially affected by CVE-2024-30253 via @solana/web3.js (1.52.0)

@solana/web3.js NPM version 1.52.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @altruism-finance/js =0.1.0, =0.3.0, =0.3.8 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@axyzsdk/js (>=0.1.0-canary.0, <=0.2.1), @axyzsdk/react (>=0.1.0-canary.0, <=0.2.1) +13 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.36.0)

@solana/web3.js NPM version 1.36.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @axyzsdk/js =0.1.0-canary.0, =0.1.0-canary.0, =0.0.7, =0.0.2, =0.0.3, =2.0.8, =0.1.46, =1.1.135, =0.1.0-alpha-11, =0.3.0, =0.0.4,...

@iwcapital/cli (>=0.3.0, <=0.3.2), @iwcapital/core (>=0.3.0, <=0.3.3) +19 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.77.2, <=1.77.3)

@solana/web3.js NPM version =1.77.2, =0.3.0, =0.3.0, =0.2.0, =0.2.20, =0.7.0-next.0, =0.0.155, =0.8.24, =0.8.19, =0.8.22, =0.8.20, =0.8.33, =0.8.23, =0.8.20, =0.8.53, =0.8.65 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@3s-wallet-core/provider (>=0.0.2, <=1.0.3), @3s-wallet-core/wallet (>=0.0.4, <=1.0.2) +23 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.89.0, <=1.89.1)

@solana/web3.js NPM version =1.89.0, =0.0.2, =0.0.4, =0.4.0-beta.25, =0.4.0-beta.30, =0.4.0-beta.30, =0.4.0-beta.30, =0.0.1, =0.0.2-beta.15, =2.34.0-rc.1, =0.0.1, =0.0.1, =0.0.1-beta, =0.4.0-beta.2, =0.4.0-beta.0, =0.1.8-beta.8, =0.4.6 and more Source cves: CVE-2024-30253 Source advisory:...

@bonfida/sns-reputation (>=0.0.1, <=0.0.7), @levelfinance/keeper (>=0.1.0, <=0.1.2) potentially affected by CVE-2024-30253 via @solana/web3.js (1.30.2)

@solana/web3.js NPM version 1.30.2 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @bonfida/sns-reputation =0.0.1, =0.1.0, =0.1.2 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@debridge-finance/solana-contracts-client (>=0.1.0, <=1.0.0), @debridge-finance/solana-utils (1.0.2) potentially affected by CVE-2024-30253 via @solana/web3.js (1.62.0)

@solana/web3.js NPM version 1.62.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @debridge-finance/solana-contracts-client =0.1.0, =1.0.0 - @debridge-finance/solana-utils 1.0.2 Source cves: CVE-2024-30253 Source...

@cardinal/namespaces-components (>=4.1.0, <=5.0.0), @frakters/fusion-pool (>=1.0.0, <=1.0.4) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.32.0)

@solana/web3.js NPM version 1.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @cardinal/namespaces-components =4.1.0, =1.0.0, =0.0.29, =0.0.32 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J...

GHSA-8M45-2RJM-J347 Handling untrusted input can result in a crash, leading to loss of availability / denial of service

Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a loss of availability...

CVE-2024-30253 Handling untrusted input can result in a crash, leading to loss of availability / denial of service

@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a...

CVE-2024-30253

@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with "@solana/web3.js" will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with "@solana/web3.js", your application/service may crash, resulting in...

web3.js 安全漏洞

Web3.js is a TypeScript implementation of the Ethernet JSON RPC API open-sourced by Web3 and related tools maintained by ChainSafe Systems. A security vulnerability exists in solana/web3.js that stems from allowing an attacker to cause an out-of-memory OOM using specific input...

CVE-2024-30253: Improper Restriction of Operations within the Bounds of a Memory Buffer

@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a...