CVE-2018-8276 (Medium) detected in multiple libraries

[dev-mend-for-github-com]

CVE-2018-8276 - Medium Severity Vulnerability

Vulnerable Libraries - ChakraCore-1.8.1.0.dll, ChakraCore-1.8.1.0.dll, microsoft.chakracore.1.8.1.nupkg, ChakraCore-1.8.1.0.dll

ChakraCore-1.8.1.0.dll

Microsoft ? Chakra Core

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to vulnerable library: /SDK/bin/Debug/netcoreapp3.1/runtimes/win7-x86/native/ChakraCore.dll,/SDK/bin/Debug/net5.0/runtimes/win7-x86/native/ChakraCore.dll

Dependency Hierarchy:

• ❌ ChakraCore-1.8.1.0.dll (Vulnerable Library)

ChakraCore-1.8.1.0.dll

Microsoft ? Chakra Core

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to vulnerable library: /SDK/bin/Debug/netcoreapp3.1/runtimes/win7-x64/native/ChakraCore.dll,/SDK/bin/Debug/net5.0/runtimes/win7-x64/native/ChakraCore.dll

Dependency Hierarchy:

• ❌ ChakraCore-1.8.1.0.dll (Vulnerable Library)

microsoft.chakracore.1.8.1.nupkg

ChakraCore is the core part of the Chakra Javascript engine that powers Microsoft Edge.

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to dependency file: /SDK/SDK.csproj

Path to vulnerable library: /crosoft.chakracore/1.8.1/microsoft.chakracore.1.8.1.nupkg

Dependency Hierarchy:

• ❌ microsoft.chakracore.1.8.1.nupkg (Vulnerable Library)

ChakraCore-1.8.1.0.dll

Microsoft ? Chakra Core

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to vulnerable library: /SDK/bin/Debug/net5.0/runtimes/win8-arm/native/ChakraCore.dll,/SDK/bin/Debug/netcoreapp3.1/runtimes/win8-arm/native/ChakraCore.dll

Dependency Hierarchy:

• ❌ ChakraCore-1.8.1.0.dll (Vulnerable Library)

Found in HEAD commit: 2cdcbe42d2efe636b5e9b1d4c29c9da6e2c9b927

Found in base branch: master

Vulnerability Details

A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed, aka "Scripting Engine Security Feature Bypass Vulnerability." This affects Microsoft Edge, ChakraCore.

Publish Date: 2018-07-11

URL: CVE-2018-8276

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: chakra-core/ChakraCore#5444

Release Date: 2018-07-11

Fix Resolution: v1.10.1

---

⛑️ Automatic Remediation is available for this issue