Out-of-Bounds Read Vulnerability in cmark-gfm Package
Summary
DEBIAN-CVE-2023-22485: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Affects cmark-gfm versions < 0.29.0.gfm.13-1. Fixed in 0.29.0.gfm.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
cmark-gfm is GitHub's fork of cmark, a library and program written in C for parsing and rendering CommonMark markdown. It is widely used for converting markdown text into HTML and other formats. The package is known for its performance and compliance with the CommonMark specification, making it a popular choice among developers. However, it has been identified to have a vulnerability that can lead to potential security risks if not addressed promptly.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2023-22485 is an out-of-bounds read that occurs in the validate_protocol function of cmark-gfm versions prior to 0.29.0.gfm.7. This flaw allows a crafted markdown document to trigger an out-of-bounds read, accessing malloc metadata. While this bug is believed to be harmless in practice, as it does not cause visible damage, it still poses a risk that could be exploited in certain scenarios.
How To Fix
Minimum fixed version
0.29.0.gfm.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade cmark-gfmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid processing untrusted markdown documents until the package is updated to the patched version. This can help mitigate the risk of exploitation while waiting for the fix to be applied.
Conclusion
The cmark-gfm package has a vulnerability that could potentially be exploited through crafted markdown documents. It is crucial to update to the patched version to mitigate any risks associated with this flaw. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for cmark-gfm →
FAQ
cmark-gfm is a library for parsing and rendering CommonMark markdown, developed as a fork of the original cmark project by GitHub.
It refers to a flaw where the program reads memory outside the bounds of allocated memory, which can lead to undefined behavior or potential information leaks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file, such as package-lock.json, to check for vulnerabilities.
While the vulnerability is considered harmless in practice, it is still advisable to apply the patch to eliminate any potential risks.
If immediate updates are not possible, refrain from using untrusted markdown documents as a temporary workaround until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for cmark-gfm.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
