Is CVE-2022-36313 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-36313 being exploited in the wild.

How severe is CVE-2022-36313?

Low severity, with a CVSS score of 3.1, published 22 July 2022.

Which products and versions are affected?

file-type (npm) SEMVER:introduced=13.0.0,fixed=16.5.4.

Is there a fix for CVE-2022-36313?

Yes. file-type (npm): upgrade to 16.5.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-36313 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-36313?

Check whether you run file-type (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-36313: file-type infinite loop via malformed MKV file

CVE-2022-36313 · Severity: low · CVSS 3.1 · Published 2022-07-22

file-type is a Node.js library that detects file types by inspecting file contents. A malformed MKV (Matroska video) file can cause the detector to enter an infinite loop, freezing the application. This can be exploited for denial-of-service attacks, especially when used in web services to render applications unresponsive.

Technologies: file-type (npm). Vendors: npm.

Quick answers

Is CVE-2022-36313 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-36313 being exploited in the wild.
How severe is CVE-2022-36313?: Low severity, with a CVSS score of 3.1, published 22 July 2022.
Which products and versions are affected?: file-type (npm) SEMVER:introduced=13.0.0,fixed=16.5.4.
Is there a fix for CVE-2022-36313?: Yes. file-type (npm): upgrade to 16.5.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-36313 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-36313?: Check whether you run file-type (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

file-type (npm): upgrade to 16.5.4 or later
```
npm install file-type@16.5.4
```

Technical details

The file-type library contains an infinite loop vulnerability (CWE-835) in its MKV file format parser, affecting versions 13.0.0 through 16.5.3 and 17.0.0 through 17.1.2. A specially crafted malformed MKV file can trigger the infinite loop when processed by the file type detector, causing the application to hang indefinitely. The vulnerability is remotely exploitable with no authentication or user interaction required, as the library processes untrusted file input. An attacker can exploit this to achieve denial of service by uploading a malicious MKV file to a web application using this library. Patches are available in versions 16.5.4 and 17.1.3.

Affected products

Sindre Sorhus file-type 13.0.0 to 16.5.3, 17.0.0 to 17.1.2

Identifiers

CVE-2022-36313
GHSA-mhxj-85r3-2x55

Timeline

2022-07-22: disclosed
2022-07-22: patched: Fixes available in versions 16.5.4 and 17.1.3
2022-07-21: other: CVE-2022-36313 published on NVD

References

https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.