Denial of Service Vulnerability in python-markdown2: CVE-2021-26813
Summary
CVE-2021-26813: markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. Affects python-markdown2 across 2 version ranges.
< 2.3.10-1.1
>= 6d11f0f1ef9e112faeaf8028f631d2f825f991a6, < 31491857f247f553c4006b7ef55823deefb9e8e9
Fixed in 2.3.10-1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-markdown2 is a Python library that converts Markdown text to HTML. It is widely used for its simplicity and efficiency in rendering Markdown content. The library supports various Markdown features and is often integrated into web applications and content management systems. However, it has been found to be vulnerable to a Denial of Service (DoS) attack due to improper handling of certain input strings.
Vulnerability Detail
CVE-2021-26813 is a regular expression denial of service vulnerability affecting markdown2 versions prior to 2.4.0. An attacker can exploit this vulnerability by providing a specially crafted input string that causes the markdown2 processing to become excessively slow or hang indefinitely. This can lead to service degradation or unavailability, impacting users and potentially allowing for further attacks.
How To Fix
Minimum fixed version
2.3.10-1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-markdown2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider implementing input validation to filter out potentially malicious strings before they reach the markdown2 processing stage. This can help mitigate the risk of exploitation.
Conclusion
CVE-2021-26813 poses a significant risk to applications using the python-markdown2 library due to its potential for denial of service attacks. It is crucial for developers to update to the latest version to safeguard their applications. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-markdown2 →
FAQ
CVE-2021-26813 is a vulnerability in the python-markdown2 library that allows for denial of service attacks through specially crafted input strings.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
Exploitation of this vulnerability can lead to service unavailability, affecting user experience and potentially allowing further attacks.
Yes, implementing input validation to filter out malicious strings can help mitigate the risk until an upgrade is performed.
The CVSS score for CVE-2021-26813 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-markdown2.
