Is CVE-2022-39381 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-39381 being exploited in the wild.

How severe is CVE-2022-39381?

Low severity, with a CVSS score of 3.1, published 2 November 2022.

Which products and versions are affected?

hummus (npm) SEMVER:introduced=0,fixed=1.0.111; muhammara (npm) SEMVER:introduced=0,fixed=2.6.0.

Is there a fix for CVE-2022-39381?

Yes. hummus (npm): upgrade to 1.0.111 or later; muhammara (npm): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-39381 attacked?

It is attacked over the network.

Am I affected by CVE-2022-39381?

Check whether you run hummus (npm) or muhammara (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-39381: Muhammara null pointer dereference in PDF append

CVE-2022-39381 · Severity: low · CVSS 3.1 · Published 2022-11-02

Muhammara and Hummus are JavaScript libraries used to programmatically manipulate PDF documents. A maliciously crafted PDF file can trigger a crash when an application attempts to append it to another PDF, causing a denial of service. Affected applications using these libraries may become unavailable if processing untrusted PDF inputs.

Technologies: hummus (npm), muhammara (npm). Vendors: npm.

Quick answers

Is CVE-2022-39381 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-39381 being exploited in the wild.
How severe is CVE-2022-39381?: Low severity, with a CVSS score of 3.1, published 2 November 2022.
Which products and versions are affected?: hummus (npm) SEMVER:introduced=0,fixed=1.0.111; muhammara (npm) SEMVER:introduced=0,fixed=2.6.0.
Is there a fix for CVE-2022-39381?: Yes. hummus (npm): upgrade to 1.0.111 or later; muhammara (npm): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-39381 attacked?: It is attacked over the network.
Am I affected by CVE-2022-39381?: Check whether you run hummus (npm) or muhammara (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hummus (npm): upgrade to 1.0.111 or later
```
npm install hummus@1.0.111
```
muhammara (npm): upgrade to 2.6.0 or later
```
npm install muhammara@2.6.0
```

Technical details

The vulnerability is an unchecked return value leading to null pointer dereference in PDFDocumentHandler.cpp. The root cause occurs when the library fails to validate that a function call returns a valid pointer before dereferencing it during PDF append operations. An attacker can exploit this by supplying a maliciously crafted PDF file that causes the vulnerable function to return NULL. The attack requires no authentication or user interaction and is reachable over the network. Successful exploitation results in a denial of service (application crash). Muhammara patched this issue in version 2.6.0; Hummus has not released a patch.

Affected products

Julian Hille Muhammara before 2.6.0
Gal Kahana Hummus all versions

Identifiers

CVE-2022-39381
GHSA-rcrx-fpjp-mfrw

Timeline

2022-11-02: disclosed: Advisory published on GitHub and OSV
2022-11-02: patched: Muhammara patched in version 2.6.0

References

https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-rcrx-fpjp-mfrw

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.