CVE-2022-25885 – muhammara

Package

Manager: npm
Name: muhammara
Vulnerable Version: >=0 <2.6.0

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS: 0.00111 pctl0.30312

Details

muhammara and hummus vulnerable to null pointer dereference on bad response object The package muhammara before 2.6.0 and the package hummus before 1.0.111 are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.

Metadata

Created: 2022-11-01T12:00:30Z
Modified: 2022-11-02T16:06:48Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-frp9-2v6r-gj97/GHSA-frp9-2v6r-gj97.json
CWE IDs: ["CWE-690"]
Alternative ID: GHSA-frp9-2v6r-gj97
Finding: F138
Auto approve: 1