Vulnerability · Published Nov 1, 2022 · Assigned by snyk
CVE-2022-25892Denial of Service (DoS)
High 7.5
In plain English
A high-severity security flaw in hummus. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.4%top 28.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | hummus | 1.0.111 | GHSA-9cv5-4wqv-9w94 |
| npm | muhammara | 2.6.1 | GHSA-9cv5-4wqv-9w94 |
| npm | muhammara | 3.1.1 | GHSA-9cv5-4wqv-9w94 |
Affected products (as reported)
References
- https://security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3060320
- https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091138
- https://github.com/julianhille/MuhammaraJS/issues/214
- https://github.com/julianhille/MuhammaraJS/commit/1890fb555eaf171db79b73fdc3ea543bbd63c002
- https://github.com/galkahana/HummusJS/issues/463
- https://github.com/julianhille/MuhammaraJS/commit/90b278d09f16062d93a4160ef0a54d449d739c51