PT-2022-17589 · Hummus+1 · Hummus+1

Julian Hille + 1 · Published 2022-11-01 · Updated 2022-12-03 · CVE-2022-25892

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions muhammara versions prior to 2.6.1 muhammara versions 3.0.0 through 3.1.0 hummus versions prior to 1.0.111

Description The issue allows for Denial of Service (DoS) when a maliciously crafted PDF file is supplied to be parsed.

Recommendations For muhammara versions prior to 2.6.1, update to version 2.6.1 or later. For muhammara versions 3.0.0 through 3.1.0, update to version 3.1.1 or later. For hummus versions prior to 1.0.111, update to version 1.0.111 or later. As a temporary workaround, do not process files from untrusted sources.

Fix

Weakness Enumeration

CWE-690

Related Identifiers

CVE-2022-25892

GHSA-9CV5-4WQV-9W94

Affected Products

Hummus

Muhammara

References · 13

• https://github.com/julianhille/MuhammaraJS/commit/1890fb555eaf171db79b73fdc3ea543bbd63c002 · Patch
• https://github.com/julianhille/MuhammaraJS/issues/214 · Patch
• https://github.com/julianhille/MuhammaraJS/commit/90b278d09f16062d93a4160ef0a54d449d739c51 · Patch
• https://osv.dev/vulnerability/GHSA-9cv5-4wqv-9w94 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25892 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25892 · Vendor Advisory
• https://github.com/galkahana/HummusJS/issues/463 · Note
• https://github.com/galkahana/HummusJS/commit/a9bf2520ab5abb69f9328906e406fbebfb36159a · Note
• https://github.com/julianhille/MuhammaraJS · Note
• https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-f64j-4x74-p42m · Note
• https://security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3060320 · Note
• https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091138 · Note
• https://t.me/cvenotify/39044 · Telegram Post