CVE-2021-32014 - SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js

Back Back to CVE browser

MEDIUM

SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js

Published Jul 19, 2021

5.5

MEDIUM

CVSS 3.1

EPSS 0.88%

Description

SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js.

Affected products

Ecosystem	Package	Introduced	Fixed
npm	xlsx	0	0.17.0
Maven	org.webjars.npm:xlsx	0	0.17.0

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-345

CWE-400

Uncontrolled Resource Consumption

References (6)

https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely/
x_refsource_MISCThird Party Advisory
https://github.com/advisories/GHSA-g973-978j-2c3p
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-32014
https://sheetjs.com/pro
x_refsource_MISCProductVendor Advisory
https://www.npmjs.com/package/xlsx/v/0.17.0
x_refsource_MISCProductThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
x_refsource_MISCPatchThird Party Advisory

Link	Providers	Tags
https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely/		x_refsource_MISCThird Party Advisory
https://github.com/advisories/GHSA-g973-978j-2c3p		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-32014
https://sheetjs.com/pro		x_refsource_MISCProductVendor Advisory
https://www.npmjs.com/package/xlsx/v/0.17.0		x_refsource_MISCProductThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html		x_refsource_MISCPatchThird Party Advisory