Publish GHSA-f67q-wr6w-23jq

2026-05-22 18:04:22 -07:00 · 2024-08-14 20:51:10 +00:00
parent f8c6339267
commit bd8b9dd691
1 changed files with 65 additions and 0 deletions
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f67q-wr6w-23jq",
+  "modified": "2024-08-14T20:49:51Z",
+  "published": "2024-08-14T20:49:51Z",
+  "aliases": [
+    "CVE-2024-43367"
+  ],
+  "summary": "Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects",
+  "details": "A wrong assumption made when handling ECMAScript's `AsyncGenerator` operations can cause an uncaught exception on certain scripts.\n\n## Details\n\nBoa's implementation of `AsyncGenerator` makes the assumption that the state of an `AsyncGenerator` object cannot change while resolving a promise created by methods of `AsyncGenerator` such as `%AsyncGeneratorPrototype%.next`, `%AsyncGeneratorPrototype%.return`, or `%AsyncGeneratorPrototype%.throw`.\nHowever, a carefully constructed code could trigger a state transition from a getter method for the promise's `then` property, which causes the engine to fail an assertion of this assumption, causing an uncaught exception. This could be used to create a Denial Of Service attack in applications that run arbitrary ECMAScript code provided by an external user.\n\n## Patches\n\nVersion 0.19.0 is patched to correctly handle this case.\n\n## Workarounds\n\nUsers unable to upgrade to the patched version would want to use [`std::panic::catch_unwind`](https://doc.rust-lang.org/std/panic/fn.catch_unwind.html) to ensure any exceptions caused by the engine don't impact the availability of the main application.\n\n## References\n\n- https://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7\n- https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "boa_engine"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.16"
+            },
+            {
+              "fixed": "0.19.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/boa-dev/boa"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-248"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-08-14T20:49:51Z",
+    "nvd_published_at": null
+  }
+}