{"id":"GHSA-c25x-cm9x-qqgx","summary":"Deno improperly handles resizable ArrayBuffer","details":"### Impact\n\n[Resizable ArrayBuffers](https://github.com/tc39/proposal-resizablearraybuffer) passed to asynchronous native functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write.\n\nIt is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0.\n\nDeno Deploy users are not affected.\n\n### Patches\n\nThe problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. A future version of Deno will re-enable resizable ArrayBuffers with a proper fix.\n\n### Workarounds\n\nUpgrade to Deno 1.32.1, or run with `--v8-flags=--no-harmony-rab-gsab` to disable resizable ArrayBuffers.","aliases":["CVE-2023-28445"],"modified":"2023-11-08T04:12:11.261571Z","published":"2023-03-23T23:13:25Z","database_specific":{"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2023-03-23T23:13:25Z","nvd_published_at":"2023-03-24T00:15:00Z","cwe_ids":["CWE-125","CWE-787"]},"references":[{"type":"WEB","url":"https://github.com/denoland/deno/security/advisories/GHSA-c25x-cm9x-qqgx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28445"},{"type":"WEB","url":"https://github.com/denoland/deno/pull/18395"},{"type":"WEB","url":"https://github.com/denoland/deno/pull/18452"},{"type":"PACKAGE","url":"https://github.com/denoland/deno"},{"type":"WEB","url":"https://github.com/denoland/deno/releases/tag/v1.32.1"}],"affected":[{"package":{"name":"Deno","ecosystem":"crates.io","purl":"pkg:cargo/Deno"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.32.0"},{"fixed":"1.32.1"}]}],"versions":["1.32.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-c25x-cm9x-qqgx/GHSA-c25x-cm9x-qqgx.json"}},{"package":{"name":"serde_v8","ecosystem":"crates.io","purl":"pkg:cargo/serde_v8"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.87.0"},{"fixed":"0.88.0"}]}],"versions":["0.87.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-c25x-cm9x-qqgx/GHSA-c25x-cm9x-qqgx.json"}},{"package":{"name":"deno_runtime","ecosystem":"crates.io","purl":"pkg:cargo/deno_runtime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.102.0"},{"fixed":"0.103.0"}]}],"versions":["0.102.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-c25x-cm9x-qqgx/GHSA-c25x-cm9x-qqgx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}