CVE-2022-25885

HIGH7.5EPSS 0.94%

muhammara and hummus vulnerable to null pointer dereference on bad response object

Published: 11/1/2022Modified: 11/8/2023

Description

The package muhammara before 2.6.0 and the package hummus before 1.0.111 are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.

Affected packages (2)

npm/hummus>= 1.0.0, < 1.0.111
npm/muhammarafrom 0, < 2.6.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (8)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-25885
PATCHhttps://github.com/julianhille/MuhammaraJS
WEBhttps://github.com/galkahana/HummusJS/commit/a9bf2520ab5abb69f9328906e406fbebfb36159a
WEBhttps://github.com/galkahana/HummusJS/issues/439
WEBhttps://github.com/julianhille/MuhammaraJS/commit/0a6427eec82ef2978995e453de2dc0d6224dd46c
WEBhttps://github.com/julianhille/MuhammaraJS/issues/188
WEBhttps://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091139
WEBhttps://security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3091137