CVE-2022-41957
Description
Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. The package muhammara before 2.6.2 and from 3.0.0 and before 3.3.0, as well as all versions of muhammara's predecessor package hummus, are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed. The issue has been patched in muhammara version 3.4.0 and the fix has been backported to version 2.6.2. As a workaround, do not process files from untrusted sources. If using hummus, replace the package with muhammara.
How to fix
- muhammara_project muhammara2.6.2, 3.3.0 or later
- muhammara3.4.0, 2.6.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| muhammara_project muhammara | v < 2.6.2, 3.0.0 ≤ v < 3.3.0 | 2.6.2, 3.3.0 |
| hummus_project hummus | No range specified | — |
| hummusnpm | No range specified | — |
| muhammaranpm | 3.0.0 ≤ v < 3.4.0, v < 2.6.2 | 3.4.0, 2.6.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.