Lucene search
F5F5:K000134725HistoryMay 22, 2023 - 12:00 a.m.
K000134725 : vm2 vulnerability CVE-2023-29017
2023-05-2200:00:00
my.f5.com
15
sandbox
remote code execution
host object
threat actor
vulnerability
unhandled async errors
patch
Security Advisory Description
vm2 is a sandbox that can run untrusted code with whitelisted Node’s built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to Error.prepareStackTrace in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds. (CVE-2023-29017)
Impact
There is no impact; F5 products are not affected by this vulnerability.
Related
cvelist
cvelist
CVE-2023-29017 vm2 Sandbox Escape vulnerability
2023-04-06 19:18:34
nessus
nessus
Node.js Module vm2 < 3.9.15 Sandbox Breakout
2023-04-07 00:00:00
osv
osv
vm2 vulnerable to sandbox escape
2023-04-07 20:35:03
CVE-2023-29017
2023-04-06 20:15:08
jsreport vulnerable to code injection
2023-05-08 18:30:17
openvas
openvas
vm2 < 3.9.15 Sandbox Escape Vulnerability
2023-05-02 00:00:00
githubexploit
githubexploit
ibm
ibm
veracode
veracode
Arbitrary Code Execution
2023-04-11 02:50:43
prion
prion
Remote code execution
2023-04-06 20:15:00
redhatcve
redhatcve
CVE-2023-29017
2023-04-08 15:59:36
nvd
nvd
CVE-2023-29017
2023-04-06 20:15:08
github
github
vm2 vulnerable to sandbox escape
2023-04-07 20:35:03
jsreport vulnerable to code injection
2023-05-08 18:30:17
cve
cve
CVE-2023-29017
2023-04-06 20:15:08
thn
thn
huntr
huntr
An outdated dependency leads to to remote command execution vulnerability
2023-04-10 16:20:04
