Electron: Mitigation for compromised eMudhra intermediate certificates
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 45.0.0-beta.6, 44.9.1, 43.8.1, 42.11.16
- Public exploit
- None on Exploit-DB
- Exploitation: none
- Automatable: no
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
Electron, a framework used to build cross-platform desktop applications with JavaScript, HTML, and CSS, is affected, including its Chromium networking and Node.js TLS, HTTPS, and fetch components. An attacker holding a certificate issued through a compromised eMudhra intermediate certificate authority who can intercept network traffic could impersonate a TLS server to the affected application.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application. This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.
Affected versions
- electron electron
From 45.0.0-alpha.1 · fixed in 45.0.0-beta.6; From 44.0.0-alpha.1 · fixed in 44.9.1; From 43.0.0-alpha.1 · fixed in 43.8.1; fixed in 42.11.16
- electronnpm
From 45.0.0-alpha.1 · fixed in 45.0.0-beta.6
- electronnpm
From 44.0.0-alpha.1 · fixed in 44.9.1
- electronnpm
From 43.0.0-alpha.1 · fixed in 43.8.1
- electronnpm
fixed in 42.11.16