GitHub Advisoryadvisory · npm

GHSA-2r7v-cmch-5x26 muhammara and hummus vulnerable to Unchecked Return Value to NULL Pointer Dereference

HIGH Published 2022-12-05 Modified 2022-12-05 Official page ↗
Aliases
CVE-2022-41957
Ecosystem
npm
Packages
hummus, muhammara
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-690
Reviewed
2022-12-05

Affected packages

• npm hummus: < 2.6.2 (no fix yet) • npm muhammara: >= 3.0.0, < 3.4.0 → fixed in 3.4.0 • npm muhammara: < 2.6.2 → fixed in 2.6.2

Description

Impact The package muhammara before 2.6.2, from 3.0.0 and before 3.3.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed. Patches It has been patched in 3.4.0 and has been backported to 2.6.2 There is no patch for hummus, currently Workarounds Do not process files from untrusted sources or update. Replace hummus with muhammara References https://github.com/julianhille/MuhammaraJS/pull/235 https://github.com/julianhille/MuhammaraJS/pull/238

Related

Alias · CVE (1)

  • CVE-2022-41957 Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. vulnerability

Weakness · CWE (1)

  • CWE-690 Unchecked Return Value to NULL Pointer Dereference weakness

References