file-type vulnerable to Infinite Loop via malformed MKV file

🗓️ 22 Jul 2022 00:00:38Reported by GitHub Advisory DatabaseType

Issue in file-type package detecting MKV file

Reporter	Title	Published	Views	Family All 17
ATTACKERKB	CVE-2022-36313	21 Jul 202216:15	–	attackerkb
Circl	CVE-2022-36313	21 Jul 202220:18	–	circl
CNNVD	Node.js 安全漏洞	21 Jul 202200:00	–	cnnvd
CVE	CVE-2022-36313	21 Jul 202215:31	–	cve
Cvelist	CVE-2022-36313	21 Jul 202215:31	–	cvelist
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to Node.js module file-type (CVE-2022-36313)	8 Nov 202211:07	–	ibm
EUVD	EUVD-2022-6377	3 Oct 202520:07	–	euvd
NVD	CVE-2022-36313	21 Jul 202216:15	–	nvd
OSV	GHSA-MHXJ-85R3-2X55 file-type vulnerable to Infinite Loop via malformed MKV file	22 Jul 202200:00	–	osv
Prion	Design/Logic Flaw	21 Jul 202216:15	–	prion

Vulners

Node

sindresorhus file-typeRange13.0.0–16.5.4npm

sindresorhus file-typeRange17.0.0–17.1.3npm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-36313
github	www.github.com/sindresorhus/file-type/releases/tag/v16.5.4
github	www.github.com/sindresorhus/file-type/releases/tag/v17.1.3
npmjs	www.npmjs.com/package/file-type
github	www.github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47
github	www.github.com/sindresorhus/file-type/commit/d86835680f4cccbee1a60628783c36700ec9e254
github	www.github.com/sindresorhus/file-type/commit/8f981c32e2750d2516457e305e502ee2ad715759
github	www.github.com/sindresorhus/file-type/compare/v12.4.2...v13.0.0
security	www.security.snyk.io/vuln/SNYK-JS-FILETYPE-2958042
security	www.security.netapp.com/advisory/ntap-20220909-0005/

28 Jan 2023 05:02Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.5

EPSS0.00171