CVE-2021-32013

Опубликовано: 19 июл. 2021

Источник: nvd

CVSS3: 5.5

CVSS2: 4.3

EPSS Низкий

Описание

SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 2 of 2).

Ссылки

https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely/
Third Party Advisory
https://sheetjs.com/pro
Product
Vendor Advisory
https://www.npmjs.com/package/xlsx/v/0.17.0
Product
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Third Party Advisory
https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely/
Third Party Advisory
https://sheetjs.com/pro
Product
Vendor Advisory
https://www.npmjs.com/package/xlsx/v/0.17.0
Product
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:sheetjs_project:sheetjs:*:*:*:*:*:node.js:*:*

Версия до 0.16.9 (включая)

cpe:2.3:a:sheetjs_project:sheetjs_pro:*:*:*:*:*:node.js:*:*

Версия до 0.16.9 (включая)

Конфигурация 2

cpe:2.3:a:oracle:rest_data_services:*:*:*:*:*:*:*:*

Версия до 21.2.4 (исключая)

EPSS

Процентиль: 44%

0.00212

Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-400

Связанные уязвимости

GHSA-8vcr-vxm8-293m