CVE-2022-25851 (High) detected in jpeg-js-0.4.3.tgz
mend-bolt-for-github opened this issue · comments
CVE-2022-25851 - High Severity Vulnerability
Vulnerable Library - jpeg-js-0.4.3.tgz
A pure javascript JPEG encoder and decoder
Library home page: https://registry.npmjs.org/jpeg-js/-/jpeg-js-0.4.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jpeg-js/package.json
Dependency Hierarchy:
- folio-0.3.18.tgz (Root Library)
❌ jpeg-js-0.4.3.tgz (Vulnerable Library)
Found in HEAD commit: b946ad8d4f25043e02c690fc58b68b199f903484
Found in base branch: master
Vulnerability Details
The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never return.
Publish Date: 2022-06-10
URL: CVE-2022-25851
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here