CVE-2022-36313CWE-835

CVE-2022-36313

Medium · published July 21, 2022

CVSS v3.1
5.5
EPSS
0%
Percentile
33.8
In the wild
Unconfirmed
What it is

An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00406 · 33.8th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2022-07-21T20:15Z
Affected products (2)
ProductVersionsFixed in
sindresorhus/file-type< 16.5.416.5.4
sindresorhus/file-type≥ 17.0.0, < 17.1.317.1.3
References (8)
https://github.com/sindresorhus/file-type/releases/tag/v16.5.4 · [email protected]https://github.com/sindresorhus/file-type/releases/tag/v17.1.3 · [email protected]https://security.netapp.com/advisory/ntap-20220909-0005/ · [email protected]https://www.npmjs.com/package/file-type · [email protected]https://github.com/sindresorhus/file-type/releases/tag/v16.5.4 · af854a3a-2127-422b-91ae-364da2661108https://github.com/sindresorhus/file-type/releases/tag/v17.1.3 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20220909-0005/ · af854a3a-2127-422b-91ae-364da2661108https://www.npmjs.com/package/file-type · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 21 JUL 15:31Z
    An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js
    cvelistv5