CVE-2022-25885 – hummus

Package

Manager: npm
Name: hummus
Vulnerable Version: >=1.0.0 <1.0.111

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS: 0.00119 pctl0.31458

Details

muhammara and hummus vulnerable to null pointer dereference on bad response object The package muhammara before 2.6.0 and the package hummus before 1.0.111 are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.

Metadata

Created: 2022-11-01T12:00:30Z
Modified: 2022-11-02T16:06:48Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-frp9-2v6r-gj97/GHSA-frp9-2v6r-gj97.json
CWE IDs: ["CWE-690"]
Alternative ID: GHSA-frp9-2v6r-gj97
Finding: F138
Auto approve: 1