CVE-2022-39381 Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp
Attackers can cause a denial of service in MuhammaraJS by supplying a maliciously crafted PDF file for appending.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-39381?
CVE-2022-39381 is a high-severity vulnerability in julianhille MuhammaraJS, published on 2 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Muhammara is a node module with c/cpp bindings to modify PDF with js for node or electron (based/replacement on/of galkhana/hummusjs). The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be appended to another. This issue has been patched in 2.6.0 for muhammara and not at all for hummus. As a workaround, do not process files from untrusted sources.
Which versions are affected by CVE-2022-39381?
4 open source packages ship an affected version, including hummus and muhammara. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
hummus npm | All versions | 1.0.111 |
hummus npm | All versions | 1.0.111 |
muhammara npm | All versions | 2.6.0 |
muhammara npm | All versions | 2.6.0 |
Products include Muhammarajs Project Muhammarajs, Pdfhummus Hummusjs.
How do I fix CVE-2022-39381?
Upgrade hummus to 1.0.111 or later.
Is CVE-2022-39381 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39381 exists.
Sources
Also known as GHSA-rcrx-fpjp-mfrw.