GHSA-mqvp-7rrg-9jxc

Source

https://github.com/advisories/GHSA-mqvp-7rrg-9jxc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-mqvp-7rrg-9jxc/GHSA-mqvp-7rrg-9jxc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mqvp-7rrg-9jxc

Aliases

CVE-2022-26336

Published

2022-03-05T00:00:44Z

Modified

2024-05-15T07:02:06.818374Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Improper Input Validation and Allocation of Resources Without Limits or Throttling in poi-scratchpad

Details

A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.

Database specific

{
    "nvd_published_at": "2022-03-04T16:15:00Z",
    "cwe_ids": [
        "CWE-20",
        "CWE-770"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-07T16:12:37Z"
}

References

Affected packages

Maven / org.apache.poi:poi-scratchpad

Package

Name: org.apache.poi:poi-scratchpad; View open source insights on deps.dev
Purl: pkg:maven/org.apache.poi/poi-scratchpad

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.8-beta1

Fixed

5.2.1

Affected versions

3.*

3.8-beta1

3.8-beta2

3.8-beta3

3.8-beta4

3.8-beta5

3.8

3.9

3.10-beta1

3.10-beta2

3.10-FINAL

3.10.1

3.11-beta1

3.11-beta2

3.11-beta3

3.11

3.12-beta1

3.12

3.13-beta1

3.13

3.14-beta1

3.14

3.15-beta1

3.15-beta2

3.15

3.16-beta1

3.16-beta2

3.16

3.17-beta1

3.17

4.*

4.0.0

4.0.1

4.1.0

4.1.1

4.1.2

5.*

5.0.0

5.1.0

5.2.0