PT-2022-26182 · Hummus+1 · Hummus+1

Julianhille · Published 2022-11-28 · Updated 2022-12-05 · CVE-2022-41957

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions muhammara versions prior to 2.6.2 muhammara versions 3.0.0 through 3.3.0 hummus (all versions)

Description The issue is related to a Denial of Service (DoS) condition that occurs when a maliciously crafted PDF file is parsed. The problem arises when the software is supplied with a specifically designed PDF file, leading to a denial of service. As a workaround, it is recommended not to process files from untrusted sources. If hummus is being used, it is advised to replace it with muhammara.

Recommendations For muhammara versions prior to 2.6.2, update to version 2.6.2 or later. For muhammara versions 3.0.0 through 3.3.0, update to version 3.4.0 or later. For hummus, replace the package with muhammara. As a temporary workaround, consider not processing files from untrusted sources until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-690

Related Identifiers

CVE-2022-41957

GHSA-2R7V-CMCH-5X26

Affected Products

Hummus

Muhammara

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41957.json · Exploit
• https://github.com/julianhille/MuhammaraJS/pull/238 · Patch
• https://github.com/julianhille/MuhammaraJS/pull/235 · Patch
• https://osv.dev/vulnerability/GHSA-2r7v-cmch-5x26 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41957 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41957 · Vendor Advisory
• https://github.com/julianhille/MuhammaraJS · Note
• https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-2r7v-cmch-5x26 · Note
• https://t.me/cibsecurity/53586 · Telegram Post