An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.
References
| Link | Resource |
|---|---|
| https://github.com/sindresorhus/file-type/releases/tag/v16.5.4 | Release Notes Third Party Advisory |
| https://github.com/sindresorhus/file-type/releases/tag/v17.1.3 | Release Notes Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20220909-0005/ | Third Party Advisory |
| https://www.npmjs.com/package/file-type | Product Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
27 Oct 2022, 13:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20220909-0005/ - Third Party Advisory |
09 Sep 2022, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
27 Jul 2022, 22:31
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CPE | cpe:2.3:a:file-type_project:file-type:*:*:*:*:*:node.js:*:* | |
| First Time |
File-type Project file-type
File-type Project |
|
| CWE | CWE-835 | |
| References | (MISC) https://www.npmjs.com/package/file-type - Product, Third Party Advisory | |
| References | (CONFIRM) https://github.com/sindresorhus/file-type/releases/tag/v17.1.3 - Release Notes, Third Party Advisory | |
| References | (CONFIRM) https://github.com/sindresorhus/file-type/releases/tag/v16.5.4 - Release Notes, Third Party Advisory |
21 Jul 2022, 16:32
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-07-21 16:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-36313
Mitre link : CVE-2022-36313
CVE.ORG link : CVE-2022-36313
JSON object : View
Products Affected
file-type_project
- file-type
CWE
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')