Vulnerability	Vulnerable Version
H Improper Verification of Cryptographic Signature electron-updater is a module allowing applications to implement auto-update functionality. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through the `windowsExecutableCodeSignatureVerifier` process. An attacker in control of an update manifest - via server compromise or other exploitation - can bypass signature verification of a downloaded file by tricking the application into verifying the signature on a different file instead. Note: This is only exploitable on Windows. How to fix Improper Verification of Cryptographic Signature? Upgrade `electron-updater` to version 6.3.0-alpha.6 or higher.	<6.3.0-alpha.6

Improper Verification of Cryptographic Signature

electron-updater is a module allowing applications to implement auto-update functionality.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through the windowsExecutableCodeSignatureVerifier process. An attacker in control of an update manifest - via server compromise or other exploitation - can bypass signature verification of a downloaded file by tricking the application into verifying the signature on a different file instead.

Note: This is only exploitable on Windows.

How to fix Improper Verification of Cryptographic Signature?

Upgrade electron-updater to version 6.3.0-alpha.6 or higher.

<6.3.0-alpha.6

Go back to all versions of this package