Electron-packager: SECURITY NOTICE: electron-packager v5.2.1 - v6.0.2 don't check SSL certificate validity
There exists a bug in electron-packager from versions 5.2.1 - 6.0.2 where the --strict-ssl command line option defaults to false when not explicitly set to true.
This only affects users using the electron-packager CLI. The strict-ssl option defaults to true for the node.js API.
The commit that introduced the issue is here: https://github.com/electron-userland/electron-packager/commit/30bdd0b187e96bc45ce20d5363104917a48fd93b
The commit that fixed the issue is here: https://github.com/electron-userland/electron-packager/commit/ebea1d8c177f2a2816687c4a445998cc35375a18
The issue is fixed in v7.0.0. All users should upgrade immediately.
It's also recommended to delete the electron-download cache folder, by default named .electron, and located in your home folder. For example:
rm -rf ~/.electron
Props to @malept for discovering this.
feross
All 13 comments
I would like to npm deprecate the broken versions, but I'm not an npm owner anymore. I used to be, but looks like someone removed me.
Can a current npm owner please run the following command:
npm deprecate electron-packager@"5.2.1-6.0.2" "Critical security bug fixed in v7.0.0 - read more at https://github.com/electron-userland/electron-packager/issues/333"
@maxogden @stefanbuck @jden @sindresorhus @kfranqueiro @jlord @malept
feross
on 19 Apr 2016
I've got it.
malept
on 19 Apr 2016
@malept Thank you.
feross
on 19 Apr 2016
I also added some clarifying text to your advisory (underlined) because the download cache is configurable.
malept
on 19 Apr 2016
@malept Good call.
feross
on 19 Apr 2016
@feross I ran the command and am attempting to verify it:
mkdir /tmp/testcase
cd /tmp/testcase
npm init .
# [...a bunch of user input...]
npm install [email protected]
I should get a warning message with the issue URL, right? (I am not.)
malept
on 19 Apr 2016
@malept You can use npm init -y :)
montogeek
on 19 Apr 2016
I have to be AFK for a bit, @feross I've (re?)added you to the npm list so you can figure out what's going on here.
@montogeek that is helpful for future testcases, but my question still stands.
malept
on 19 Apr 2016
I just tested it, not warning message
montogeek ~/test [09:02 PM]→ 😛
👉 npm install -D [email protected]
[email protected] /Users/montogeek/test
└─┬ [email protected]
├─┬ [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ ├─┬ [email protected]
│ │ │ └── [email protected]
│ │ ├── [email protected]
│ │ └── [email protected]
│ ├─┬ [email protected]
│ │ └─┬ [email protected]
│ │ ├── [email protected]
│ │ └── [email protected]
│ └─┬ [email protected]
│ ├─┬ [email protected]
│ │ ├─┬ [email protected]
│ │ │ ├── [email protected]
│ │ │ └─┬ [email protected]
│ │ │ └── [email protected]
│ │ ├── [email protected]
│ │ ├─┬ [email protected]
│ │ │ └── [email protected]
│ │ ├── [email protected]
│ │ ├─┬ [email protected]
│ │ │ └── [email protected]
│ │ └─┬ [email protected]
│ │ └── [email protected]
│ └─┬ [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ ├─┬ [email protected]
│ │ ├── [email protected]
│ │ ├─┬ [email protected]
│ │ │ ├── [email protected]
│ │ │ ├── [email protected]
│ │ │ ├─┬ [email protected]
│ │ │ │ └── [email protected]
│ │ │ ├── [email protected]
│ │ │ └── [email protected]
│ │ └─┬ [email protected]
│ │ ├── [email protected]
│ │ ├─┬ [email protected]
│ │ │ └── [email protected]
│ │ ├── [email protected]
│ │ └── [email protected]
│ ├─┬ [email protected]
│ │ ├── [email protected]
│ │ ├── [email protected]
│ │ ├── [email protected]
│ │ └── [email protected]
│ ├─┬ [email protected]
│ │ ├── [email protected]
│ │ ├── [email protected]
│ │ └── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ └── [email protected]
├─┬ [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ ├─┬ [email protected]
│ │ │ ├── [email protected]
│ │ │ └─┬ [email protected]
│ │ │ ├─┬ [email protected]
│ │ │ │ └── [email protected]
│ │ │ ├── [email protected]
│ │ │ ├─┬ [email protected]
│ │ │ │ ├── [email protected]
│ │ │ │ └── [email protected]
│ │ │ ├── [email protected]
│ │ │ ├─┬ [email protected]
│ │ │ │ ├── [email protected]
│ │ │ │ ├─┬ [email protected]
│ │ │ │ │ └── [email protected]
│ │ │ │ ├── [email protected]
│ │ │ │ └─┬ [email protected]
│ │ │ │ ├─┬ [email protected]
│ │ │ │ │ └── [email protected]
│ │ │ │ └─┬ [email protected]
│ │ │ │ └── [email protected]
│ │ │ ├─┬ [email protected]
│ │ │ │ ├─┬ [email protected]
│ │ │ │ │ ├── [email protected]
│ │ │ │ │ └─┬ [email protected]
│ │ │ │ │ └── [email protected]
│ │ │ │ └─┬ [email protected]
│ │ │ │ ├─┬ [email protected]
│ │ │ │ │ ├─┬ [email protected]
│ │ │ │ │ │ └─┬ [email protected]
│ │ │ │ │ │ └── [email protected]
│ │ │ │ │ ├── [email protected]
│ │ │ │ │ └─┬ [email protected]
│ │ │ │ │ └── [email protected]
│ │ │ │ └── [email protected]
│ │ │ ├─┬ [email protected]
│ │ │ │ ├─┬ [email protected]
│ │ │ │ │ └─┬ [email protected]
│ │ │ │ │ └─┬ [email protected]
│ │ │ │ │ └── [email protected]
│ │ │ │ └── [email protected]
│ │ │ └── [email protected]
│ │ ├─┬ [email protected]
│ │ │ ├── [email protected]
│ │ │ └─┬ [email protected]
│ │ │ └─┬ [email protected]
│ │ │ └── [email protected]
│ │ ├── [email protected]
│ │ └── [email protected]
│ ├── [email protected]
│ └─┬ [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ └── [email protected]
├── [email protected]
├─┬ [email protected]
│ ├─┬ [email protected]
│ │ ├─┬ [email protected]
│ │ │ ├── [email protected]
│ │ │ ├── [email protected]
│ │ │ ├── [email protected]
│ │ │ └── [email protected]
│ │ └── [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected]
├─┬ [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ └── [email protected]
├─┬ [email protected]
│ ├── [email protected]
│ └─┬ [email protected]
│ └── [email protected]
├── [email protected]
├─┬ [email protected]
│ └── [email protected]
├─┬ [email protected]
│ └── [email protected]
├── [email protected]
├── [email protected]
├─┬ [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ └── [email protected]
├── [email protected]
├── [email protected]
├─┬ [email protected]
│ └── [email protected]
└── [email protected]
npm WARN [email protected] No description
npm WARN [email protected] No repository field.
Does npm deprecate give any output? I ran it twice, each time it took ~a dozen seconds to run and then exited.
malept
on 19 Apr 2016
Looks like the syntax was slightly off. Should be ">= 5.2.1 | <= 6.0.2".
I ran the command, so now everyone should be getting the warning.
feross
on 19 Apr 2016
I recommend leaving this issue open for at least a few weeks, so more users will have a chance to read this and upgrade.
feross
on 19 Apr 2016
It's been a few weeks, so closing. I think the deprecation notice is sufficient.
malept
on 11 May 2016
Related issues
akcorp2003
·
4Comments
andreabisello
·
3Comments
pushkin-
·
4Comments
NoahAndrews
·
5Comments
corvinrok
·
4Comments
Most helpful comment
I recommend leaving this issue open for at least a few weeks, so more users will have a chance to read this and upgrade.