Bug 2210172 (CVE-2023-24824) - CVE-2023-24824 commonmarker: Quadratic complexity bugs may lead to a denial of service
Summary: CVE-2023-24824 commonmarker: Quadratic complexity bugs may lead to a denial o...
Keywords:
Status: NEW
Alias: CVE-2023-24824
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2210313 2210312 2210646
Blocks: 2210175
TreeView+ depends on / blocked
 
Reported: 2023-05-26 03:49 UTC by Avinash Hanwate
Modified: 2023-09-05 19:21 UTC (History)
5 users (show)

Fixed In Version: cmark-gfm 0.29.0.gfm.10
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in CommonMarker. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description Avinash Hanwate 2023-05-26 03:49:56 UTC
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.

https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59

Comment 2 Patrick Del Bello 2023-05-26 14:49:13 UTC
Created ghc-cmark-gfm tracking bugs for this issue:

Affects: fedora-all [bug 2210312]


Created ghostwriter tracking bugs for this issue:

Affects: fedora-all [bug 2210313]


Note You need to log in before you can comment on or make changes to this bug.