Description
The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | muhammara | unspecified – < 2.6.1, 3.1.0 – < unspecified, unspecified – < 3.1.1 | 2.6.1 |
| — | hummus | < unspecified | unspecified |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | hummus | < 1.0.111 | 1.0.111 | GHSA-9cv5-4wqv-9w94 |
| npm | muhammara | < 2.6.1 | 2.6.1 | GHSA-9cv5-4wqv-9w94 |
| npm | muhammara | >= 3.0.0, < 3.1.1 | 3.1.1 | GHSA-9cv5-4wqv-9w94 |
References
- https://security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3060320
- https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091138
- https://github.com/julianhille/MuhammaraJS/issues/214
- https://github.com/julianhille/MuhammaraJS/commit/1890fb555eaf171db79b73fdc3ea543bbd63c002
- https://github.com/galkahana/HummusJS/issues/463
- https://github.com/julianhille/MuhammaraJS/commit/90b278d09f16062d93a4160ef0a54d449d739c51