logo

Database

Insecure functionality In muhammara

Description

muhammara and hummus vulnerable to denial of service by NULL pointer dereference

Impact

The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.

Patches

It has been patched in 3.1.1 and has been backported to 2.6.1 Hummus has a patch in 1.0.111.

Workarounds

Do not process files from untrusted sources or update.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-25892 https://github.com/galkahana/HummusJS/issues/463 https://github.com/julianhille/MuhammaraJS/issues/214 https://github.com/julianhille/MuhammaraJS/commit/1890fb555eaf171db79b73fdc3ea543bbd63c002 https://github.com/julianhille/MuhammaraJS/commit/90b278d09f16062d93a4160ef0a54d449d739c51

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2022-258922. NVD-2022-258923. OSV-2022-258924. GHSA-f64j-4x74-p42m5. GCVE-2022-25892

References

1. https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-f64j-4x74-p42m2. https://github.com/galkahana/HummusJS/issues/4633. https://github.com/julianhille/MuhammaraJS/issues/2144. https://github.com/galkahana/HummusJS/commit/a9bf2520ab5abb69f9328906e406fbebfb36159a5. https://github.com/julianhille/MuhammaraJS/commit/1890fb555eaf171db79b73fdc3ea543bbd63c0026. https://github.com/julianhille/MuhammaraJS/commit/90b278d09f16062d93a4160ef0a54d449d739c51

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.