Is CVE-2022-25885 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-25885 being exploited in the wild.

How severe is CVE-2022-25885?

Low severity, with a CVSS score of 3.1, published 1 November 2022.

Which products and versions are affected?

Galkahana HummusJS before 1.0.111; Julian Hille MuhammaraJS before 2.6.0; hummus (npm) SEMVER:introduced=1.0.0,fixed=1.0.111; muhammara (npm) SEMVER:introduced=0,fixed=2.6.0.

Is there a fix for CVE-2022-25885?

Yes. hummus (npm): upgrade to 1.0.111 or later; muhammara (npm): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-25885 attacked?

It is attacked over the network.

Am I affected by CVE-2022-25885?

Check whether you run Galkahana HummusJS, Julian Hille MuhammaraJS, hummus (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-25885: muhammara and hummus null pointer dereference in PDFStreamForResponse

CVE-2022-25885 · Severity: low · CVSS 3.1 · Published 2022-11-01

muhammara and hummus are JavaScript libraries used to create and manipulate PDF documents. Both libraries crash with a denial of service when the PDFStreamForResponse function is passed invalid or null input, causing the application to terminate unexpectedly and disrupting service availability.

Technologies: hummus (npm), muhammara (npm). Vendors: npm.

Quick answers

Is CVE-2022-25885 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-25885 being exploited in the wild.
How severe is CVE-2022-25885?: Low severity, with a CVSS score of 3.1, published 1 November 2022.
Which products and versions are affected?: Galkahana HummusJS before 1.0.111; Julian Hille MuhammaraJS before 2.6.0; hummus (npm) SEMVER:introduced=1.0.0,fixed=1.0.111; muhammara (npm) SEMVER:introduced=0,fixed=2.6.0.
Is there a fix for CVE-2022-25885?: Yes. hummus (npm): upgrade to 1.0.111 or later; muhammara (npm): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-25885 attacked?: It is attacked over the network.
Am I affected by CVE-2022-25885?: Check whether you run Galkahana HummusJS, Julian Hille MuhammaraJS, hummus (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hummus (npm): upgrade to 1.0.111 or later
```
npm install hummus@1.0.111
```
muhammara (npm): upgrade to 2.6.0 or later
```
npm install muhammara@2.6.0
```

Technical details

The vulnerability is a null pointer dereference (CWE-690) in the PDFStreamForResponse() function that fails to validate input parameters. When invalid data (including null values) is passed to PDFStreamForResponse, the library attempts to dereference a null pointer while writing PDF headers, causing an application crash. No authentication or special privileges are required; the vulnerability can be triggered by any code path that calls PDFStreamForResponse with malformed input. An attacker can cause a denial of service by crafting a request that leads to the vulnerable function being called with bad data. Patches are available in muhammara version 2.6.0 and hummus version 1.0.111.

Affected products

Galkahana HummusJS before 1.0.111
Julian Hille MuhammaraJS before 2.6.0

Identifiers

CVE-2022-25885
GHSA-frp9-2v6r-gj97

Timeline

2022-11-01: disclosed: Published in GitHub Advisory Database
2022-11-01: patched: Hummus 1.0.111 and muhammara 2.6.0 released with fixes

References

https://github.com/galkahana/HummusJS/issues/439

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.