Vulnerability-Lookup

CVE-2022-36313 (GCVE-0-2022-36313)

Vulnerability from cvelistv5 – Published: 2022-07-21 15:31 – Updated: 2026-10-07 18:50

Summary

An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 18:49 UTC

CWE

n/a
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

mitre CNA under the mitre root

CNA scorecard E 29/100 over 2338 records in the last 180 days details

References

4 references

URL	Tags
https://www.npmjs.com/package/file-type	x_refsource_MISC
https://github.com/sindresorhus/file-type/release…	x_refsource_CONFIRM
https://github.com/sindresorhus/file-type/release…	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2022090…	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:00:04.274Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.npmjs.com/package/file-type"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220909-0005/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-36313",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T18:49:40.209210Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-835",
                "description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T18:50:18.094Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-09T17:06:19.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.npmjs.com/package/file-type"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220909-0005/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2022-36313",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.npmjs.com/package/file-type",
              "refsource": "MISC",
              "url": "https://www.npmjs.com/package/file-type"
            },
            {
              "name": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3",
              "refsource": "CONFIRM",
              "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3"
            },
            {
              "name": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4",
              "refsource": "CONFIRM",
              "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220909-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220909-0005/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-36313",
    "datePublished": "2022-07-21T15:31:27.000Z",
    "dateReserved": "2022-07-20T00:00:00.000Z",
    "dateUpdated": "2026-10-07T18:50:18.094Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-36313",
      "date": "2026-10-24",
      "epss": "0.00406",
      "percentile": "0.33841"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "n/a",
                "vendor": "n/a",
                "versions": [
                  {
                    "status": "affected",
                    "version": "n/a"
                  }
                ]
              }
            ],
            "source": "cve@mitre.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:sindresorhus:file-type:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "C6629A6A-016C-4E85-B052-41FA687B81B8",
                    "versionEndExcluding": "16.5.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sindresorhus:file-type:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "D7E323E8-78C3-46D3-AB10-E727572E2D6F",
                    "versionEndExcluding": "17.1.3",
                    "versionStartIncluding": "17.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack."
          },
          {
            "lang": "es",
            "value": "Se ha detectado un problema en el paquete file-type versiones anteriores a 16.5.4 y 17.x anteriores a 17.1.3 para Node.js. Un archivo MKV malformado pod\u00eda causar que el detector de tipo de archivo quedara atrapado en un bucle infinito. Esto har\u00eda que la aplicaci\u00f3n dejara de responder y podr\u00eda usarse para causar un ataque DoS"
          }
        ],
        "id": "CVE-2022-36313",
        "lastModified": "2026-10-07T19:17:30.503",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-36313",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T18:49:40.209210Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2022-07-21T16:15:09.297",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220909-0005/"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Product",
              "Third Party Advisory"
            ],
            "url": "https://www.npmjs.com/package/file-type"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220909-0005/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Product",
              "Third Party Advisory"
            ],
            "url": "https://www.npmjs.com/package/file-type"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-835"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-835"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-08T03:00:00+00:00",
      "cve": "CVE-2022-36313",
      "id": "CVE-2022-36313",
      "initial_release_date": "2022-07-21T00:00:00+00:00",
      "product_status:fixed": "1",
      "product_status:known_affected": "8",
      "product_status:known_not_affected": "4",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "file-type: a malformed MKV file could cause the file type detector to get caught in an infinite loop",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-36313.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T10:00:04.274Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://www.npmjs.com/package/file-type"
              },
              {
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3"
              },
              {
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4"
              },
              {
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://security.netapp.com/advisory/ntap-20220909-0005/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "REQUIRED",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-36313",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-07T18:49:40.209210Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-835",
                    "description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-07T18:49:53.538Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "n/a",
              "vendor": "n/a",
              "versions": [
                {
                  "status": "affected",
                  "version": "n/a"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "n/a",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2022-09-09T17:06:19.000Z",
            "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            "shortName": "mitre"
          },
          "references": [
            {
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://www.npmjs.com/package/file-type"
            },
            {
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3"
            },
            {
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4"
            },
            {
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://security.netapp.com/advisory/ntap-20220909-0005/"
            }
          ],
          "x_legacyV4Record": {
            "CVE_data_meta": {
              "ASSIGNER": "cve@mitre.org",
              "ID": "CVE-2022-36313",
              "STATE": "PUBLIC"
            },
            "affects": {
              "vendor": {
                "vendor_data": [
                  {
                    "product": {
                      "product_data": [
                        {
                          "product_name": "n/a",
                          "version": {
                            "version_data": [
                              {
                                "version_value": "n/a"
                              }
                            ]
                          }
                        }
                      ]
                    },
                    "vendor_name": "n/a"
                  }
                ]
              }
            },
            "data_format": "MITRE",
            "data_type": "CVE",
            "data_version": "4.0",
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack."
                }
              ]
            },
            "problemtype": {
              "problemtype_data": [
                {
                  "description": [
                    {
                      "lang": "eng",
                      "value": "n/a"
                    }
                  ]
                }
              ]
            },
            "references": {
              "reference_data": [
                {
                  "name": "https://www.npmjs.com/package/file-type",
                  "refsource": "MISC",
                  "url": "https://www.npmjs.com/package/file-type"
                },
                {
                  "name": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3",
                  "refsource": "CONFIRM",
                  "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3"
                },
                {
                  "name": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4",
                  "refsource": "CONFIRM",
                  "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4"
                },
                {
                  "name": "https://security.netapp.com/advisory/ntap-20220909-0005/",
                  "refsource": "CONFIRM",
                  "url": "https://security.netapp.com/advisory/ntap-20220909-0005/"
                }
              ]
            }
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "assignerShortName": "mitre",
        "cveId": "CVE-2022-36313",
        "datePublished": "2022-07-21T15:31:27.000Z",
        "dateReserved": "2022-07-20T00:00:00.000Z",
        "dateUpdated": "2026-10-07T18:50:18.094Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2023-AVI-0976

Vulnerability from certfr_avis - Published: 2023-11-23 - Updated: 2023-11-23

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
IBM	Sterling Connect:Direct	Services Web IBM Sterling Connect:Direct versions 6.2.x antérieures à 6.2.0.20
IBM	Sterling Connect:Direct	Interface utilisateur IBM Sterling Connect:Direct versions 1.x antérieures à 1.5.0.2 iFix-39
IBM	QRadar	Agent QRadar WinCollect (Standalone) versions antérieures à 10.1.8
IBM	Sterling Connect:Direct	Services Web IBM Sterling Connect:Direct versions 6.0.x à 6.1.x antérieures à 6.1.0.22
IBM	QRadar	Suite QRadar versions 1.10.x antérieures à 1.10.17.0
IBM	Sterling	IBM Sterling B2B Integrator versions 6.0.x antérieures à 6.0.3.9
IBM	Sterling	IBM Sterling B2B Integrator versions 6.1.0.x à 6.1.2.x antérieures à 6.1.2.3
IBM	Cloud Pak	Cloud Pak for Security versions 1.10.x antérieures à 1.10.17.0
IBM	Sterling Connect:Direct	Services Web IBM Sterling Connect:Direct versions 6.3.x antérieures à 6.3.0.5

References

Title

Publication Time

Tags

Bulletin de sécurité IBM 7080118 du 20 novembre 2023	None	vendor-advisory
Bulletin de sécurité IBM 7080174 du 21 novembre 2023	None	vendor-advisory
Bulletin de sécurité IBM 7080106 du 20 novembre 2023	None	vendor-advisory
Bulletin de sécurité IBM 7080058 du 20 novembre 2023	None	vendor-advisory
Bulletin de sécurité IBM 7080117 du 20 novembre 2023	None	vendor-advisory
Bulletin de sécurité IBM 7080177 du 21 novembre 2023	None	vendor-advisory
Bulletin de sécurité IBM 7080176 du 21 novembre 2023	None	vendor-advisory
Bulletin de sécurité IBM 7081403 du 22 novembre 2023	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Services Web IBM Sterling Connect:Direct versions 6.2.x ant\u00e9rieures \u00e0 6.2.0.20",
      "product": {
        "name": "Sterling Connect:Direct",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Interface utilisateur IBM Sterling Connect:Direct versions 1.x ant\u00e9rieures \u00e0 1.5.0.2 iFix-39",
      "product": {
        "name": "Sterling Connect:Direct",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Agent QRadar WinCollect (Standalone) versions ant\u00e9rieures \u00e0 10.1.8",
      "product": {
        "name": "QRadar",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Services Web IBM Sterling Connect:Direct versions 6.0.x \u00e0 6.1.x ant\u00e9rieures \u00e0 6.1.0.22",
      "product": {
        "name": "Sterling Connect:Direct",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Suite QRadar versions 1.10.x ant\u00e9rieures \u00e0 1.10.17.0",
      "product": {
        "name": "QRadar",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Sterling B2B Integrator versions 6.0.x ant\u00e9rieures \u00e0 6.0.3.9",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Sterling B2B Integrator versions 6.1.0.x \u00e0 6.1.2.x ant\u00e9rieures \u00e0 6.1.2.3",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Pak for Security versions 1.10.x ant\u00e9rieures \u00e0 1.10.17.0",
      "product": {
        "name": "Cloud Pak",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Services Web IBM Sterling Connect:Direct versions 6.3.x ant\u00e9rieures \u00e0 6.3.0.5",
      "product": {
        "name": "Sterling Connect:Direct",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-27191",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-27191"
    },
    {
      "name": "CVE-2021-37701",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701"
    },
    {
      "name": "CVE-2022-24921",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24921"
    },
    {
      "name": "CVE-2022-28327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-28327"
    },
    {
      "name": "CVE-2022-36313",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-36313"
    },
    {
      "name": "CVE-2021-42248",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-42248"
    },
    {
      "name": "CVE-2021-33196",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33196"
    },
    {
      "name": "CVE-2021-31525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31525"
    },
    {
      "name": "CVE-2021-32804",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-32804"
    },
    {
      "name": "CVE-2021-33198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33198"
    },
    {
      "name": "CVE-2022-45061",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45061"
    },
    {
      "name": "CVE-2020-16845",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-16845"
    },
    {
      "name": "CVE-2022-25883",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-25883"
    },
    {
      "name": "CVE-2020-28367",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28367"
    },
    {
      "name": "CVE-2022-41966",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41966"
    },
    {
      "name": "CVE-2022-0391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0391"
    },
    {
      "name": "CVE-2021-38297",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38297"
    },
    {
      "name": "CVE-2020-10735",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10735"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2023-26279",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26279"
    },
    {
      "name": "CVE-2022-40153",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40153"
    },
    {
      "name": "CVE-2021-41771",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41771"
    },
    {
      "name": "CVE-2021-33197",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33197"
    },
    {
      "name": "CVE-2021-27918",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27918"
    },
    {
      "name": "CVE-2021-37713",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-37713"
    },
    {
      "name": "CVE-2020-15586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15586"
    },
    {
      "name": "CVE-2021-39293",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39293"
    },
    {
      "name": "CVE-2021-37712",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712"
    },
    {
      "name": "CVE-2022-38749",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-38749"
    },
    {
      "name": "CVE-2023-36478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36478"
    },
    {
      "name": "CVE-2022-40152",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40152"
    },
    {
      "name": "CVE-2021-4189",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-4189"
    },
    {
      "name": "CVE-2021-3426",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3426"
    },
    {
      "name": "CVE-2022-24675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24675"
    },
    {
      "name": "CVE-2021-32803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-32803"
    },
    {
      "name": "CVE-2022-40151",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40151"
    },
    {
      "name": "CVE-2022-23806",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23806"
    },
    {
      "name": "CVE-2021-36221",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36221"
    },
    {
      "name": "CVE-2022-23773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23773"
    },
    {
      "name": "CVE-2021-3737",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3737"
    },
    {
      "name": "CVE-2022-23772",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23772"
    },
    {
      "name": "CVE-2022-36777",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-36777"
    },
    {
      "name": "CVE-2023-32001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32001"
    },
    {
      "name": "CVE-2021-41772",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41772"
    },
    {
      "name": "CVE-2017-18640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-18640"
    },
    {
      "name": "CVE-2021-3114",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3114"
    },
    {
      "name": "CVE-2023-34104",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34104"
    },
    {
      "name": "CVE-2021-29923",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-29923"
    },
    {
      "name": "CVE-2022-41854",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41854"
    },
    {
      "name": "CVE-2020-24553",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-24553"
    },
    {
      "name": "CVE-2021-42836",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-42836"
    },
    {
      "name": "CVE-2021-44716",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44716"
    },
    {
      "name": "CVE-2023-1255",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1255"
    },
    {
      "name": "CVE-2020-28362",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28362"
    },
    {
      "name": "CVE-2022-25857",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-25857"
    },
    {
      "name": "CVE-2022-38751",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-38751"
    },
    {
      "name": "CVE-2022-38752",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-38752"
    },
    {
      "name": "CVE-2023-24998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-24998"
    },
    {
      "name": "CVE-2022-38750",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-38750"
    },
    {
      "name": "CVE-2022-40156",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40156"
    },
    {
      "name": "CVE-2022-40155",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40155"
    },
    {
      "name": "CVE-2022-1471",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471"
    },
    {
      "name": "CVE-2023-41080",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41080"
    },
    {
      "name": "CVE-2023-38039",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38039"
    },
    {
      "name": "CVE-2015-20107",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-20107"
    },
    {
      "name": "CVE-2021-39008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39008"
    },
    {
      "name": "CVE-2020-14039",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14039"
    },
    {
      "name": "CVE-2022-40154",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40154"
    },
    {
      "name": "CVE-2020-28366",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28366"
    },
    {
      "name": "CVE-2021-33195",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33195"
    },
    {
      "name": "CVE-2022-48303",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48303"
    }
  ],
  "initial_release_date": "2023-11-23T00:00:00",
  "last_revision_date": "2023-11-23T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0976",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-11-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7080118 du 20 novembre 2023",
      "url": "https://www.ibm.com/support/pages/node/7080118"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7080174 du 21 novembre 2023",
      "url": "https://www.ibm.com/support/pages/node/7080174"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7080106 du 20 novembre 2023",
      "url": "https://www.ibm.com/support/pages/node/7080106"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7080058 du 20 novembre 2023",
      "url": "https://www.ibm.com/support/pages/node/7080058"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7080117 du 20 novembre 2023",
      "url": "https://www.ibm.com/support/pages/node/7080117"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7080177 du 21 novembre 2023",
      "url": "https://www.ibm.com/support/pages/node/7080177"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7080176 du 21 novembre 2023",
      "url": "https://www.ibm.com/support/pages/node/7080176"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7081403 du 22 novembre 2023",
      "url": "https://www.ibm.com/support/pages/node/7081403"
    }
  ]
}

FKIE_CVE-2022-36313

Vulnerability from fkie_nvd - Published: 2022-07-21 16:15 - Updated: 2026-10-07 19:17

Severity

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
cve@mitre.org	https://github.com/sindresorhus/file-type/releases/tag/v16.5.4	Release Notes, Third Party Advisory
cve@mitre.org	https://github.com/sindresorhus/file-type/releases/tag/v17.1.3	Release Notes, Third Party Advisory
cve@mitre.org	https://security.netapp.com/advisory/ntap-20220909-0005/	Third Party Advisory
cve@mitre.org	https://www.npmjs.com/package/file-type	Product, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/sindresorhus/file-type/releases/tag/v16.5.4	Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/sindresorhus/file-type/releases/tag/v17.1.3	Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security.netapp.com/advisory/ntap-20220909-0005/	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.npmjs.com/package/file-type	Product, Third Party Advisory

Impacted products

	Vendor	Product	Version
	sindresorhus	file-type	*
	sindresorhus	file-type	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sindresorhus:file-type:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "C6629A6A-016C-4E85-B052-41FA687B81B8",
              "versionEndExcluding": "16.5.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sindresorhus:file-type:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "D7E323E8-78C3-46D3-AB10-E727572E2D6F",
              "versionEndExcluding": "17.1.3",
              "versionStartIncluding": "17.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack."
    },
    {
      "lang": "es",
      "value": "Se ha detectado un problema en el paquete file-type versiones anteriores a 16.5.4 y 17.x anteriores a 17.1.3 para Node.js. Un archivo MKV malformado pod\u00eda causar que el detector de tipo de archivo quedara atrapado en un bucle infinito. Esto har\u00eda que la aplicaci\u00f3n dejara de responder y podr\u00eda usarse para causar un ataque DoS"
    }
  ],
  "id": "CVE-2022-36313",
  "lastModified": "2026-10-07T19:17:30.503",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-36313",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-07T18:49:40.209210Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2022-07-21T16:15:09.297",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20220909-0005/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product",
        "Third Party Advisory"
      ],
      "url": "https://www.npmjs.com/package/file-type"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20220909-0005/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product",
        "Third Party Advisory"
      ],
      "url": "https://www.npmjs.com/package/file-type"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

FSA-202302

Vulnerability from csaf_festosecokg - Published: 2023-07-10 10:00 - Updated: 2026-02-02 08:00

Summary

Festo: Several vulnerabilities in FactoryViews

Scope

173 vulnerabilities in this advisory, including CVE-2022-36313.

CVE-2022-36313

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Fixed: 2 products Known affected: 2 products

Open the full advisory

GHSA-MHXJ-85R3-2X55

Vulnerability from github – Published: 2022-07-22 00:00 – Updated: 2022-08-16 15:42

Summary

file-type vulnerable to Infinite Loop via malformed MKV file

Details

An issue was discovered in the file-type package from 13.0.0 until 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack when used on a web server.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "file-type"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "13.0.0"
            },
            {
              "fixed": "16.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "file-type"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "17.0.0"
            },
            {
              "fixed": "17.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-36313"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-22T20:26:05Z",
    "nvd_published_at": "2022-07-21T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in the file-type package from 13.0.0 until 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack when used on a web server.",
  "id": "GHSA-mhxj-85r3-2x55",
  "modified": "2022-08-16T15:42:27Z",
  "published": "2022-07-22T00:00:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36313"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sindresorhus/file-type/commit/8f981c32e2750d2516457e305e502ee2ad715759#diff-c853b2249e99790d8725774cf63c90c5ab17112067df6e267f3701d7bf591d12"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sindresorhus/file-type/commit/d86835680f4cccbee1a60628783c36700ec9e254"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sindresorhus/file-type"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sindresorhus/file-type/compare/v12.4.2...v13.0.0#diff-c853b2249e99790d8725774cf63c90c5ab17112067df6e267f3701d7bf591d12R611-R613"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20220909-0005"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-FILETYPE-2958042"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/file-type"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "file-type vulnerable to Infinite Loop via malformed MKV file"
}

GSD-2022-36313

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-36313

Aliases

CVE-2022-36313

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-36313",
    "description": "An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.",
    "id": "GSD-2022-36313",
    "references": [
      "https://access.redhat.com/errata/RHSA-2023:0713"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-36313"
      ],
      "details": "An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.",
      "id": "GSD-2022-36313",
      "modified": "2023-12-13T01:19:21.347666Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2022-36313",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.npmjs.com/package/file-type",
            "refsource": "MISC",
            "url": "https://www.npmjs.com/package/file-type"
          },
          {
            "name": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3",
            "refsource": "CONFIRM",
            "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3"
          },
          {
            "name": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4",
            "refsource": "CONFIRM",
            "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20220909-0005/",
            "refsource": "CONFIRM",
            "url": "https://security.netapp.com/advisory/ntap-20220909-0005/"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c16.5.4||\u003e=17.0.0 \u003c17.1.3",
          "affected_versions": "All versions before 16.5.4, all versions starting from 17.0.0 before 17.1.3",
          "cvss_v3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-835",
            "CWE-937"
          ],
          "date": "2022-10-27",
          "description": "An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.",
          "fixed_versions": [
            "16.5.4",
            "17.1.3"
          ],
          "identifier": "CVE-2022-36313",
          "identifiers": [
            "CVE-2022-36313",
            "GHSA-mhxj-85r3-2x55"
          ],
          "not_impacted": "All versions starting from 16.5.4 before 17.0.0, all versions starting from 17.1.3",
          "package_slug": "npm/file-type",
          "pubdate": "2022-07-21",
          "solution": "Upgrade to versions 16.5.4, 17.1.3 or above.",
          "title": "file-type vulnerable to Infinite Loop via malformed MKV file",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-36313",
            "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4",
            "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3",
            "https://www.npmjs.com/package/file-type",
            "https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47",
            "https://github.com/sindresorhus/file-type/commit/d86835680f4cccbee1a60628783c36700ec9e254",
            "https://github.com/advisories/GHSA-mhxj-85r3-2x55"
          ],
          "uuid": "5dc8c987-74da-4e79-995a-22d3cc085bc0"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:file-type_project:file-type:*:*:*:*:*:node.js:*:*",
                "cpe_name": [],
                "versionEndExcluding": "17.1.3",
                "versionStartIncluding": "17.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:file-type_project:file-type:*:*:*:*:*:node.js:*:*",
                "cpe_name": [],
                "versionEndExcluding": "16.5.4",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2022-36313"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-835"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4",
              "refsource": "CONFIRM",
              "tags": [
                "Release Notes",
                "Third Party Advisory"
              ],
              "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4"
            },
            {
              "name": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3",
              "refsource": "CONFIRM",
              "tags": [
                "Release Notes",
                "Third Party Advisory"
              ],
              "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3"
            },
            {
              "name": "https://www.npmjs.com/package/file-type",
              "refsource": "MISC",
              "tags": [
                "Product",
                "Third Party Advisory"
              ],
              "url": "https://www.npmjs.com/package/file-type"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220909-0005/",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.netapp.com/advisory/ntap-20220909-0005/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-10-27T13:25Z",
      "publishedDate": "2022-07-21T16:15Z"
    }
  }
}

RHSA-2023:0713

Vulnerability from csaf_redhat - Published: 2023-02-09 11:35 - Updated: 2026-10-22 20:55

Summary

Red Hat Security Advisory: Red Hat Data Grid 8.4.1 security update

Severity

Important

Scope

6 vulnerabilities in this advisory, including CVE-2022-36313.

CVE-2022-36313

A flaw was found in the file-type npm package. A malformed MKV file could lead the file type detector to a denial of Service. This issue allows an attacker to input a malicious file and make the server unresponsive.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2023:0713

Open the full advisory

WID-SEC-W-2022-0800

Vulnerability from csaf_certbund - Published: 2022-07-21 22:00 - Updated: 2023-02-09 23:00

Summary

Node.js: Schwachstelle ermöglicht Denial of Service

Severity

Mittel

Scope

1 vulnerability in this advisory, including CVE-2022-36313.

CVE-2022-36313

Es existiert eine Schwachstelle in Node.js. Diese besteht im "file type detector" im Modul "file-type package". Mithilfe einer speziell angefertigten MKV-Datei kann diese Schwachstelle ausgenutzt werden, um einen Infinite-Loop Zustand herzustellen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service Zustand herbeizuführen.

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-36313 (GCVE-0-2022-36313)

CERTFR-2023-AVI-0976

Solution

FKIE_CVE-2022-36313

FSA-202302

GHSA-MHXJ-85R3-2X55

GSD-2022-36313

RHSA-2023:0713

WID-SEC-W-2022-0800

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour