Lucene search

SnykCVE-2022-25892

HistoryNov 01, 2022 - 5:15 a.m.

CVE-2022-25892

2022-11-0105:15:10

snyk

web.nvd.nist.gov

cve-2022-25892

nvd

pdf

dos

security vulnerability

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

61.3%

JSON

The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.

Affected configurations

Nvd

Node

muhammara_projectmuhammara

muhammara_projectmuhammaraRange<2.6.1

muhammara_projectmuhammaraMatch3.0.0

muhammara_projectmuhammaraMatch3.1.0

VendorProductVersionCPE
muhammara_projectmuhammara*cpe:2.3:a:muhammara_project:muhammara:*:*:*:*:*:*:*:*
muhammara_projectmuhammara3.0.0cpe:2.3:a:muhammara_project:muhammara:3.0.0:*:*:*:*:*:*:*
muhammara_projectmuhammara3.1.0cpe:2.3:a:muhammara_project:muhammara:3.1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
muhammara_project	muhammara	*	cpe:2.3:a:muhammara_project:muhammara::::::::
muhammara_project	muhammara	3.0.0	cpe:2.3:a:muhammara_project:muhammara:3.0.0:::::::*
muhammara_project	muhammara	3.1.0	cpe:2.3:a:muhammara_project:muhammara:3.1.0:::::::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "muhammara",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "2.6.1",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "3.1.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "3.1.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "n/a",
    "product": "hummus",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/galkahana/HummusJS/issues/463

github.com/julianhille/MuhammaraJS/commit/1890fb555eaf171db79b73fdc3ea543bbd63c002

github.com/julianhille/MuhammaraJS/commit/90b278d09f16062d93a4160ef0a54d449d739c51

github.com/julianhille/MuhammaraJS/issues/214

security.snyk.io/vuln/SNYK-JS-HUMMUS-3091138

security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3060320

Social References

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

61.3%

JSON

Related for CVE-2022-25892