PT-2021-19625 · Sheetjs+2 · Sheetjs+2

Published 2021-07-19 · Updated 2022-02-28 · CVE-2021-32012

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: SheetJS versions through 0.16.9 SheetJS Pro versions through 0.16.9

Description: The issue allows attackers to cause a denial of service due to memory consumption via a crafted .xlsx document that is mishandled when read by xlsx.js.

Recommendations: For SheetJS versions through 0.16.9, update to a version later than 0.16.9 to resolve the issue. For SheetJS Pro versions through 0.16.9, update to a version later than 0.16.9 to resolve the issue. As a temporary workaround, consider restricting the use of xlsx.js to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-32012

GHSA-3X9F-74H4-2FQR

Affected Products

Sheetjs

Sheetjs Pro

Xlsx.Js

References · 9

• https://osv.dev/vulnerability/CVE-2021-32012 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32012 · Security Note
• https://sheetjs.com/pro · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3x9f-74h4-2fqr · Vendor Advisory
• https://t.me/cvenotify/18251 · Telegram Post
• https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely · Note
• https://npmjs.com/package/xlsx/v/0.17.0 · Note
• https://t.me/cvenotify/17836 · Telegram Post