Bug 2210172 (CVE-2023-24824)

Summary:	CVE-2023-24824 cmark-gfm: Quadratic complexity bugs may lead to a denial of service
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akostadi, amasferr, cbartlet, chazlett, dmayorov, jlledo, mmakovy, petersen, tjochec
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	cmark-gfm 0.29.0.gfm.10	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in CommonMarker. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2210312, 2210313, 2210646
Bug Blocks:	2210175

Description Avinash Hanwate 2023-05-26 03:49:56 UTC

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.

https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59

Comment 2 Patrick Del Bello 2023-05-26 14:49:13 UTC

Created ghc-cmark-gfm tracking bugs for this issue:

Affects: fedora-all [bug 2210312]


Created ghostwriter tracking bugs for this issue:

Affects: fedora-all [bug 2210313]

Comment 8 errata-xmlrpc 2025-06-03 00:41:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:8427 https://access.redhat.com/errata/RHSA-2025:8427