CVE-2022-25885: muhammara and hummus vulnerable to null pointer dereference on bad response object
The package muhammara before 2.6.0; all versions of package hummus is vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.
References
- github.com/advisories/GHSA-frp9-2v6r-gj97
- github.com/galkahana/HummusJS/issues/293
- github.com/galkahana/HummusJS/issues/439
- github.com/julianhille/MuhammaraJS/commit/0a6427eec82ef2978995e453de2dc0d6224dd46c
- github.com/julianhille/MuhammaraJS/issues/188
- github.com/julianhille/MuhammaraJS/issues/191
- github.com/julianhille/MuhammaraJS/pull/194
- github.com/julianhille/MuhammaraJS/security/advisories/GHSA-rcrx-fpjp-mfrw
- nvd.nist.gov/vuln/detail/CVE-2022-25885
- security.snyk.io/vuln/SNYK-JS-HUMMUS-3091139
- security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3091137
Code Behaviors & Features
Detect and mitigate CVE-2022-25885 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →