[BUG] [VULN] Latest version 10.x (chrome 92.0) vulnerable to CVE-2021-30551 which was fixed on 91.0.4472.101

alixaxel / chrome-aws-lambda

Chromium Binary for AWS Lambda and Google Cloud Functions

MIT License

3.2k stars 292 forks source link

[BUG] [VULN] Latest version 10.x (chrome 92.0) vulnerable to CVE-2021-30551 which was fixed on 91.0.4472.101 #261

Closed 0xSombra closed 2 years ago

0xSombra commented 2 years ago

Latest version 10.* using chromium 884014 is still vulnerable to CVE-2021-30551 which was patched on 91.0.4472.101

Looking at chromium at this commit, we find this DEPS at commit 622fd file Which means it's using V8 at commit b0bf136 Version 9.2.227 The CVE fix was committed on commit f9857fd Version 9.3.0+ (?)

Please recompile chromium with the updated v8

0xSombra commented 2 years ago

Just realized it's puppeteer's fault for using r884014. oops! I guess this is a duplicate of #254 I see there are problems with v11, v12 and v13. Updating to v10.4.0 should be enough to fix this issue