GitHub Advisoryadvisory · npm

GHSA-frp9-2v6r-gj97 muhammara and hummus vulnerable to null pointer dereference on bad response object

HIGH Published 2022-11-01 Modified 2022-11-02 Official page ↗
Aliases
CVE-2022-25885
Ecosystem
npm
Packages
hummus, muhammara
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-690
Reviewed
2022-11-01

Affected packages

• npm hummus: >= 1.0.0, < 1.0.111 → fixed in 1.0.111 • npm muhammara: < 2.6.0 → fixed in 2.6.0

Description

The package muhammara before 2.6.0 and the package hummus before 1.0.111 are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.

Related

Alias · CVE (1)

  • CVE-2022-25885 The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is… vulnerability

Weakness · CWE (1)

  • CWE-690 Unchecked Return Value to NULL Pointer Dereference weakness

References