En bref
- CVE-2022-41957 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant muhammara (muhammara project), hummus, muhammara.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.1%, plus élevée que 67.0% des vulnérabilités.
- Correctif : mettre à jour vers 3.3.0, 2.6.2, 3.4.0 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| muhammara | ≥ 3.0.0, < 3.3.0< 2.6.2
| 3.3.02.6.2
|
| hummus npm | all versions
| No fix yet |
| muhammara npm | ≥ 3.0.0, < 3.4.0< 2.6.2
| 3.4.02.6.2
|
Description
Impact
The package muhammara before 2.6.2, from 3.0.0 and before 3.3.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.
Patches
It has been patched in 3.4.0 and has been backported to 2.6.2
There is no patch for hummus, currently
Workarounds
Do not process files from untrusted sources or update.
Replace hummus with muhammara
References
https://github.com/julianhille/MuhammaraJS/pull/235
https://github.com/julianhille/MuhammaraJS/pull/238
NVD description
Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. The package muhammara before 2.6.2 and from 3.0.0 and before 3.3.0, as well as all versions of muhammara's predecessor package hummus, are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed. The issue has been patched in muhammara version 3.4.0 and the fix has been backported to version 2.6.2. As a workaround, do not process files from untrusted sources. If using hummus, replace the package with muhammara.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free