~ / search / GHSA-frp9-2v6r-gj97

GHSA-frp9-2v6r-gj97

muhammara and hummus vulnerable to null pointer dereference on bad response object

Source: GitHub Advisory Database (reviewed) High CVE-2022-25885

Packages

EcosystemPackageAffectedFixed in
npm hummus >= 1.0.0, < 1.0.111 1.0.111
npm muhammara < 2.6.0 2.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

The package muhammara before 2.6.0 and the package hummus before 1.0.111 are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.

References

External links from the advisory. They lead to third-party sites.