Fluid Attacks Database

Description

muhammara and hummus vulnerable to null pointer dereference on bad response object The package muhammara before 2.6.0 and the package hummus before 1.0.111 are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	muhammara	>=0 <2.6.0	2.6.0
npm	hummus	>=1.0.0 <1.0.111	1.0.111

Aliases

1. CVE-2022-258852. NVD-2022-258853. OSV-2022-258854. GCVE-2022-25885

References

1. https://github.com/galkahana/HummusJS/issues/4392. https://github.com/julianhille/MuhammaraJS/issues/1883. https://github.com/galkahana/HummusJS/commit/a9bf2520ab5abb69f9328906e406fbebfb36159a4. https://github.com/julianhille/MuhammaraJS/commit/0a6427eec82ef2978995e453de2dc0d6224dd46c

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.