CVE-2018-8452 (Medium) detected in multiple libraries

[dev-mend-for-github-com]

CVE-2018-8452 - Medium Severity Vulnerability

Vulnerable Libraries - microsoft.chakracore.1.8.1.nupkg, ChakraCore-1.8.1.0.dll, ChakraCore-1.8.1.0.dll, ChakraCore-1.8.1.0.dll

microsoft.chakracore.1.8.1.nupkg

ChakraCore is the core part of the Chakra Javascript engine that powers Microsoft Edge.

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to dependency file: /SDK/SDK.csproj

Path to vulnerable library: /crosoft.chakracore/1.8.1/microsoft.chakracore.1.8.1.nupkg

Dependency Hierarchy:

• ❌ microsoft.chakracore.1.8.1.nupkg (Vulnerable Library)

ChakraCore-1.8.1.0.dll

Microsoft ? Chakra Core

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to vulnerable library: /SDK/bin/Debug/netcoreapp3.1/runtimes/win7-x86/native/ChakraCore.dll,/SDK/bin/Debug/net5.0/runtimes/win7-x86/native/ChakraCore.dll

Dependency Hierarchy:

• ❌ ChakraCore-1.8.1.0.dll (Vulnerable Library)

ChakraCore-1.8.1.0.dll

Microsoft ? Chakra Core

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to vulnerable library: /SDK/bin/Debug/netcoreapp3.1/runtimes/win7-x64/native/ChakraCore.dll,/SDK/bin/Debug/net5.0/runtimes/win7-x64/native/ChakraCore.dll

Dependency Hierarchy:

• ❌ ChakraCore-1.8.1.0.dll (Vulnerable Library)

ChakraCore-1.8.1.0.dll

Microsoft ? Chakra Core

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to vulnerable library: /SDK/bin/Debug/net5.0/runtimes/win8-arm/native/ChakraCore.dll,/SDK/bin/Debug/netcoreapp3.1/runtimes/win8-arm/native/ChakraCore.dll

Dependency Hierarchy:

• ❌ ChakraCore-1.8.1.0.dll (Vulnerable Library)

Found in HEAD commit: 2cdcbe42d2efe636b5e9b1d4c29c9da6e2c9b927

Found in base branch: master

Vulnerability Details

An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers, aka "Scripting Engine Information Disclosure Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge.

Publish Date: 2018-09-13

URL: CVE-2018-8452

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: chakra-core/ChakraCore#5688

Release Date: 2018-09-13

Fix Resolution: v1.11.1

---

⛑️ Automatic Remediation is available for this issue