Bug 2318862 (CVE-2024-44337) - CVE-2024-44337 gomarkdown/markdown: infinite loop via the paragraph function of parser/block.go
Summary: CVE-2024-44337 gomarkdown/markdown: infinite loop via the paragraph function ...
Keywords:
Status: NEW
Alias: CVE-2024-44337
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2319554 2318980
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-10-15 20:02 UTC by OSIDB Bzimport
Modified: 2025-03-17 23:45 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2024-10-15 20:02:26 UTC
The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `v0.0.0-20240729232818-a2a9c4f`, which corresponds with commit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252`, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252` contains fixes to this problem.


Note You need to log in before you can comment on or make changes to this bug.