PT-2022-23309 · Npm · File-Type

Published 2022-07-21 · Updated 2022-10-27 · CVE-2022-36313

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions file-type versions 13.0.0 through 16.5.4 file-type versions 17.x before 17.1.3

Description An issue was discovered in the file-type package for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop, making the application become unresponsive. This could be used to cause a Denial of Service (DoS) attack, particularly when used on a web server.

Recommendations For versions 13.0.0 through 16.5.4, update to version 16.5.4 or later. For versions 17.x before 17.1.3, update to version 17.1.3 or later. As a temporary workaround, consider restricting the handling of MKV files until a patch is available.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2022-36313

GHSA-MHXJ-85R3-2X55

Affected Products

File-Type

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2022-36313 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36313 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mhxj-85r3-2x55 · Vendor Advisory
• https://github.com/sindresorhus/file-type · Note
• https://github.com/sindresorhus/file-type/releases/tag/v17.1.3 · Note
• https://github.com/sindresorhus/file-type/releases/tag/v16.5.4 · Note
• https://github.com/sindresorhus/file-type/compare/v12.4.2...v13.0.0#diff-c853b2249e99790d8725774cf63c90c5ab17112067df6e267f3701d7bf591d12R611-R613 · Note
• https://github.com/sindresorhus/file-type/commit/d86835680f4cccbee1a60628783c36700ec9e254 · Note
• https://github.com/sindresorhus/file-type/commit/8f981c32e2750d2516457e305e502ee2ad715759#diff-c853b2249e99790d8725774cf63c90c5ab17112067df6e267f3701d7bf591d12 · Note
• https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47 · Note
• https://security.netapp.com/advisory/ntap-20220909-0005 · Note
• https://security.snyk.io/vuln/SNYK-JS-FILETYPE-2958042 · Note
• https://npmjs.com/package/file-type · Note
• https://t.me/cibsecurity/46757 · Telegram Post