high7.5
CVE-2022-25885
muhammara and hummus vulnerable to null pointer dereference on bad response object
Impact
The package muhammara before 2.6.0 and the package hummus before 1.0.111 are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | muhammara | < 2.6.0 | 2.6.0 |
| npm | hummus | >= 1.0.0, <= 1.0.110 | 1.0.111 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Muhammara Project | Muhammara | before 2.6.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/galkahana/HummusJS/issues/439
- https://github.com/julianhille/MuhammaraJS/commit/0a6427eec82ef2978995e453de2dc0d6224dd46c
- https://github.com/julianhille/MuhammaraJS/issues/188
- https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091139
- https://security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3091137
- https://github.com/advisories/GHSA-frp9-2v6r-gj97
- https://nvd.nist.gov/vuln/detail/CVE-2022-25885
- https://github.com/galkahana/HummusJS/commit/a9bf2520ab5abb69f9328906e406fbebfb36159a