Nixpkgs security tracker
5.9 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): None (N)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
References
Affected products
- ==>= 42.0.0-alpha.1, < 42.0.0-beta.1
- ==>= 41.0.0-alpha.1, < 41.2.0
- ==>= 40.0.0-alpha.1, < 40.9.0
- ==< 39.8.7
Matching in nixpkgs
pkgs.electron
Cross platform desktop application shell
pkgs.electron_38
None
pkgs.electron_39
Cross platform desktop application shell
pkgs.electron_40
Cross platform desktop application shell
pkgs.electron_41
Cross platform desktop application shell
pkgs.electron_42
Cross platform desktop application shell
pkgs.electron_43
Cross platform desktop application shell
pkgs.electron-bin
Cross platform desktop application shell
pkgs.electron-cash
Bitcoin Cash SPV Wallet
pkgs.electron-mail
Unofficial Election-based ProtonMail desktop client
pkgs.electron-fiddle
Easiest way to get started with Electron
pkgs.electron_38-bin
None
pkgs.electron_39-bin
Cross platform desktop application shell
pkgs.electron_40-bin
Cross platform desktop application shell
pkgs.electron_41-bin
Cross platform desktop application shell
pkgs.electron_42-bin
Cross platform desktop application shell
pkgs.electron_43-bin
Cross platform desktop application shell
pkgs.todoist-electron
To-Do List App & Task Manager
pkgs.jitsi-meet-electron
Jitsi Meet desktop application powered by Electron
pkgs.electron-chromedriver
WebDriver server for running Selenium tests on Chrome
pkgs.idrisPackages.electron
Electron bindings for Idris
-
nixos-unstable 2016-03-07
- nixpkgs-unstable 2016-03-07
- nixos-unstable-small 2016-03-07
-
nixos-26.05 2016-03-07
- nixos-26.05-small 2016-03-07
- nixpkgs-26.05-darwin 2016-03-07
pkgs.electron-chromedriver_38
None
pkgs.electron-chromedriver_39
WebDriver server for running Selenium tests on Chrome
pkgs.electron-chromedriver_40
WebDriver server for running Selenium tests on Chrome
pkgs.electron-chromedriver_41
WebDriver server for running Selenium tests on Chrome
pkgs.electron-chromedriver_42
WebDriver server for running Selenium tests on Chrome
pkgs.electron-chromedriver_43
WebDriver server for running Selenium tests on Chrome
Package maintainers
-
@yayayayaka Yaya <github@uwu.is>
-
@teutat3s teutat3s <teutates@mailbox.org>
-
@TomaSajt TomaSajt
-
@oxalica oxalica <oxalicc@pm.me>
-
@nyanloutre Paul Trehiou <paul@nyanlout.re>
-
@liam-murphy14 Liam Murphy <liam.murphy137@gmail.com>
-
@andersk Anders Kaseorg <andersk@mit.edu>
-
@BatteredBunny BatteredBunny <ayes2022@protonmail.com>
-
@Princemachiavelli Josh Hoffer <jhoffer@sansorgan.es>
-
@brainrake Marton Boros <martonboros@gmail.com>
-
@Lassulus Lassulus <lassulus@gmail.com>
-
@novmar Marcel Novotny <novotny@marnov.cz>
-
@ryantm Ryan Mulligan <ryan@ryantm.com>
-
@kylesferrazza Kyle Sferrazza <nixpkgs@kylesferrazza.com>
-
@pokon548 Bu Kun <nix@bukn.uk>