Executive brief
The muhammara and hummus libraries, which are used to create and modify PDF files in Node.js applications, are vulnerable to a denial-of-service flaw. An attacker can provide a specially crafted PDF file that, when processed by the library, causes the application to crash. This can lead to service outages and impact the availability of applications that handle user-uploaded PDF documents.
Technical details
A NULL pointer dereference vulnerability exists in the muhammara and hummus Node.js packages due to unchecked return values in the underlying C++ PDF parsing logic. Specifically, functions such as GetGlyphCharString, QueryObject, and GetPageTreeChild can return NULL when processing malformed PDF data; if these returns are not validated, the application attempts to dereference the pointer, resulting in a segmentation fault and process crash. The vulnerability can be triggered remotely if the application processes untrusted PDF files. The issue is patched in muhammara versions 2.6.2 and 3.4.0. The hummus package is deprecated and remains vulnerable; users are advised to migrate to muhammara.
Affected products
- julianhille muhammara < 2.6.2, >= 3.0.0 < 3.4.0
- galkhana hummus All versions
Timeline
- 2022-11-28: advisory: NVD published CVE-2022-41957
- 2022-12-05: disclosed: GitHub Advisory published
- 2022-11-24: patched: Fixes merged into muhammara repository