CVE-2020-1065 (High) detected in multiple libraries

[dev-mend-for-github-com]

CVE-2020-1065 - High Severity Vulnerability

Vulnerable Libraries - ChakraCore-1.8.1.0.dll, ChakraCore-1.8.1.0.dll, microsoft.chakracore.1.8.1.nupkg, ChakraCore-1.8.1.0.dll

ChakraCore-1.8.1.0.dll

Microsoft ? Chakra Core

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to vulnerable library: /SDK/bin/Debug/net5.0/runtimes/win8-arm/native/ChakraCore.dll,/SDK/bin/Debug/netcoreapp3.1/runtimes/win8-arm/native/ChakraCore.dll

Dependency Hierarchy:

• ❌ ChakraCore-1.8.1.0.dll (Vulnerable Library)

ChakraCore-1.8.1.0.dll

Microsoft ? Chakra Core

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to vulnerable library: /SDK/bin/Debug/netcoreapp3.1/runtimes/win7-x86/native/ChakraCore.dll,/SDK/bin/Debug/net5.0/runtimes/win7-x86/native/ChakraCore.dll

Dependency Hierarchy:

• ❌ ChakraCore-1.8.1.0.dll (Vulnerable Library)

microsoft.chakracore.1.8.1.nupkg

ChakraCore is the core part of the Chakra Javascript engine that powers Microsoft Edge.

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to dependency file: /SDK/SDK.csproj

Path to vulnerable library: /crosoft.chakracore/1.8.1/microsoft.chakracore.1.8.1.nupkg

Dependency Hierarchy:

• ❌ microsoft.chakracore.1.8.1.nupkg (Vulnerable Library)

ChakraCore-1.8.1.0.dll

Microsoft ? Chakra Core

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to vulnerable library: /SDK/bin/Debug/netcoreapp3.1/runtimes/win7-x64/native/ChakraCore.dll,/SDK/bin/Debug/net5.0/runtimes/win7-x64/native/ChakraCore.dll

Dependency Hierarchy:

• ❌ ChakraCore-1.8.1.0.dll (Vulnerable Library)

Found in HEAD commit: 2cdcbe42d2efe636b5e9b1d4c29c9da6e2c9b927

Found in base branch: master

Vulnerability Details

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'.

Publish Date: 2020-05-21

URL: CVE-2020-1065

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/Microsoft/ChakraCore/wiki/Roadmap

Release Date: 2020-05-21

Fix Resolution: Microsoft.ChakraCore - 1.11.19

---

⛑️ Automatic Remediation is available for this issue