Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Several quadratic complexity bugs in commonmarker's underlying cmark-gfm library may lead to unbounded resource exhaustion and subsequent denial of service. The following vulnerabilities were addressed: CVE-2023-37463 For more information, consult the release notes for version 0.29.0.gfm.12. Mitigation Users are advised to upgrade to commonmarker version 0.23.10.
Recommended action: Upgrade to 0.23.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Several quadratic complexity bugs in commonmarker's underlying cmark-gfm library may lead to unbounded resource exhaustion and subsequent denial of service. The following vulnerabilities were addressed: CVE-2023-24824 CVE-2023-26485 For more information, consult the release notes for version 0.23.0.gfm.10 and 0.23.0.gfm.11. Mitigation Users are advised to upgrade to commonmarker version 0.23.9.
Recommended action: Upgrade to 0.23.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Several quadratic complexity bugs in commonmarker's underlying cmark-gfm library may lead to unbounded resource exhaustion and subsequent denial of service. The following vulnerabilities were addressed: CVE-2023-22483 CVE-2023-22484 CVE-2023-22485 CVE-2023-22486 For more information, consult the release notes for version 0.23.0.gfm.7. Mitigation Users are advised to upgrade to commonmarker version 0.23.7.
Recommended action: Upgrade to 0.23.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact CommonMarker uses cmark-gfm for rendering Github Flavored Markdown. A polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Patches This vulnerability has been patched in the following CommonMarker release: - v0.23.6 Workarounds Disable use of the autolink extension. References https://github.com/gjtorikian/commonmarker/pull/190 https://github.com/github/cmark-gfm/security/advisories/GHSA-cgh3-p57x-9q7q https://en.wikipedia.org/wiki/Timecomplexity For more information If you have any questions or comments about this advisory: Open an issue in github/cmark-gfm Acknowledgements We would like to thank Legit Security for reporting this vulnerability.
Recommended action: Upgrade to 0.23.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact CommonMarker uses cmark-gfm for rendering Github Flavored Markdown. An integer overflow in cmark-gfm's table row parsing may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution. If affected versions of CommonMarker are used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE). Patches This vulnerability has been patched in the following CommonMarker release: - v0.23.4 Workarounds The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling any use of the table extension will prevent this vulnerability from being triggered. References - https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x Acknowledgements We would like to thank Felix Wilhelm of Google's Project Zero for reporting this vulnerability For more information If you have any…
Recommended action: Upgrade to 0.23.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.