CVE-2023-22499

描述

### Impact Multi-threaded programs were able to spoof interactive permission prompt by rewriting the prompt to suggest that program is waiting on user confirmation to unrelated action. A malicious program could clear the terminal screen after permission prompt was shown and write a generic message like so: ``` // Expected prompt ⚠️ ┌ Deno requests read access to "./log.txt". ├ Requested by `Deno.open()` API ├ Run again with --allow-read to bypass this prompt. └ Allow? [y/n] (y = yes, allow; n = no, deny) > // Prompt that users would see Do you want to continue? ``` This situation impacts users who use Web Worker API and relied on interactive permission prompt. The reproduction is very timing sensitive and can’t be reliably reproduced on every try. This problem can not be exploited on systems that do not attach an interactive prompt (for example headless servers). ### Patches The problem has been fixed in Deno v1.29.3; it is recommended all users update to this version. ### Workarounds Run with `--no-prompt` flag to disable interactive permission prompts.

如何修補 CVE-2023-22499

要修補 CVE-2023-22499,請將受影響套件升級到下列已修補版本。

• —升級至 1.29.3 或更新版本

CVE-2023-22499 正在被利用嗎?

低 — EPSS 為 0.6%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 1.9.0, < 1.29.3

CVSS 分數