PT-2022-17585 · Hummus+1 · Hummus+1

Julian Hille · Published 2022-11-01 · Updated 2022-11-01 · CVE-2022-25885

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions muhammara versions prior to 2.6.0 hummus versions prior to 1.0.111

Description The issue allows for Denial of Service (DoS) when the PDFStreamForResponse() function is used with invalid data.

Recommendations For muhammara versions prior to 2.6.0, update to version 2.6.0 or later. For hummus versions prior to 1.0.111, update to version 1.0.111 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-690

CWE-20

Related Identifiers

CVE-2022-25885

GHSA-FRP9-2V6R-GJ97

Affected Products

Hummus

Muhammara

References · 10

• 🔥 https://github.com/galkahana/HummusJS/issues/439 · Exploit
• 🔥 https://github.com/julianhille/MuhammaraJS/issues/188 · Exploit
• https://github.com/julianhille/MuhammaraJS/commit/0a6427eec82ef2978995e453de2dc0d6224dd46c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-25885 · Security Note
• https://osv.dev/vulnerability/GHSA-frp9-2v6r-gj97 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25885 · Vendor Advisory
• https://github.com/galkahana/HummusJS/commit/a9bf2520ab5abb69f9328906e406fbebfb36159a · Note
• https://github.com/julianhille/MuhammaraJS · Note
• https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091139 · Note
• https://security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3091137 · Note