github - ghsa-mqvp-7rrg-9jxc

ghsa-mqvp-7rrg-9jxc

Vulnerability from github

Published

2022-03-05 00:00

Modified

2024-05-15 06:54

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

Improper Input Validation and Allocation of Resources Without Limits or Throttling in poi-scratchpad

Details

A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.poi:poi-scratchpad"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.8-beta1"
            },
            {
              "fixed": "5.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-26336"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-07T16:12:37Z",
    "nvd_published_at": "2022-03-04T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.",
  "id": "GHSA-mqvp-7rrg-9jxc",
  "modified": "2024-05-15T06:54:28Z",
  "published": "2022-03-05T00:00:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26336"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/sprg0kq986pc2271dc3v2oxb1f9qx09j"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20221028-0006"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Input Validation and Allocation of Resources Without Limits or Throttling in poi-scratchpad"
}

cve-2022-26336

Vulnerability from cvelistv5

Published

2022-03-04 00:00

Modified

2024-08-03 05:03

Severity ?

Summary

References

▼	URL	Tags
	https://lists.apache.org/thread/sprg0kq986pc2271dc3v2oxb1f9qx09j
	https://security.netapp.com/advisory/ntap-20221028-0006/

Impacted products

Vendor

Product

Version

▼

Apache Software Foundation

poi-scratchpad

Version: unspecified <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:03:32.643Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/sprg0kq986pc2271dc3v2oxb1f9qx09j"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20221028-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "poi-scratchpad",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "5.2.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Apache POI would like to thank Craig Haft of Yahoo Inc. for reporting and providing a patch for this issue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "moderate"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-28T00:00:00",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "url": "https://lists.apache.org/thread/sprg0kq986pc2271dc3v2oxb1f9qx09j"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20221028-0006/"
        }
      ],
      "source": {
        "defect": [
          "https://bz.apache.org/bugzilla/show_bug.cgi?id=65899"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "A carefully crafted TNEF file can cause an out of memory exception",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-26336",
    "datePublished": "2022-03-04T00:00:00",
    "dateReserved": "2022-03-01T00:00:00",
    "dateUpdated": "2024-08-03T05:03:32.643Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted