PT-2021-19626 · Sheetjs+2 · Sheetjs+2

Published 2021-07-19 · Updated 2022-02-28 · CVE-2021-32013

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: SheetJS versions through 0.16.9 SheetJS Pro versions through 0.16.9

Description: The issue allows attackers to cause a denial of service due to memory consumption via a crafted .xlsx document that is mishandled when read by xlsx.js.

Recommendations: For SheetJS versions through 0.16.9, update to a version later than 0.16.9 to resolve the issue. For SheetJS Pro versions through 0.16.9, update to a version later than 0.16.9 to resolve the issue.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-32013

GHSA-8VCR-VXM8-293M

Affected Products

Sheetjs

Sheetjs Pro

Xlsx.Js

References · 10

• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32013 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32013 · Vendor Advisory
• https://sheetjs.com/pro · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8vcr-vxm8-293m · Vendor Advisory
• https://t.me/cvenotify/17835 · Telegram Post
• https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely · Note
• https://npmjs.com/package/xlsx/v/0.17.0 · Note
• https://t.me/cvenotify/18249 · Telegram Post
• https://t.me/cvenotify/27496 · Telegram Post