CVE-2021-32012 Denial of Service in SheetJS Pro
MediumCVSS 5.5
EPSS 0.88%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 1 of 2).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm xlsx(npm) | < 0.17.0 | 0.17.0 |
| org.webjars.npm/xlsx(Maven) | < 0.17.0 | 0.17.0 |
| org.webjars.npm/xlsx(Maven) | = 0.12.11 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.12.13 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.12.5 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.14.0 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.14.1 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.14.3 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.14.5 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.15.0 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.15.1 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.15.2 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.15.3 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.15.4 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.15.5 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.15.6 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.16.6 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.16.7 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.16.8 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.16.9 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.8.0 | No fix listed |
| org.webjars.npm/xlsx(Maven) | = 0.9.13 | No fix listed |
| sheetjs project sheetjs | <= 0.16.9 | No fix listed |
| sheetjs project sheetjs pro | <= 0.16.9 | No fix listed |
| oracle rest data services | < 21.2.4 | 21.2.4 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- floqast.com third-party-advisory
- sheetjs.com product vendor-advisory
- www.npmjs.com product third-party-advisory
- www.oracle.com patch third-party-advisory
- github.com