CVE-2022-41957 muhammara vulnerable to Unchecked Return Value to NULL Pointer Dereference
Attackers can cause denial of service in applications using the muhammara library by supplying maliciously crafted PDF files for parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-41957?
CVE-2022-41957 is a high-severity vulnerability in julianhille MuhammaraJS, published on 28 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. The package muhammara before 2.6.2 and from 3.0.0 and before 3.3.0, as well as all versions of muhammara's predecessor package hummus, are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed. The issue has been patched in muhammara version 3.4.0 and the fix has been backported to version 2.6.2. As a workaround, do not process files from untrusted sources. If using hummus, replace the package with muhammara.
Weakness: CWE-690
Which versions are affected by CVE-2022-41957?
6 open source packages ship an affected version, including muhammara and hummus. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
muhammara npm | All versions | 2.6.2 |
muhammara npm | All versions | 2.6.2 |
muhammara npm | From 3.0.0 | 3.4.0 |
muhammara npm | From 3.0.0 | 3.4.0 |
hummus npm | All versions | None |
hummus npm | All versions | None |
Products include Hummus Project Hummus, Muhammara Project Muhammara.
How do I fix CVE-2022-41957?
Upgrade muhammara to a fixed version for your release line: 2.6.2 or 3.4.0.
Is CVE-2022-41957 being exploited?
There is no known exploitation of CVE-2022-41957 in the wild and no public exploit code.
Sources
Also known as GHSA-2r7v-cmch-5x26.