Denial of Service Vulnerability in cmark-gfm Package
Summary
DEBIAN-CVE-2023-22486: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Affects cmark-gfm versions < 0.29.0.gfm.13-1. Fixed in 0.29.0.gfm.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cmark-gfm is GitHub's fork of cmark, a library and program written in C for parsing and rendering CommonMark. It is widely used for converting Markdown into HTML and other formats. The package is known for its performance and compliance with CommonMark specifications. However, certain versions of cmark-gfm are susceptible to a vulnerability that can lead to resource exhaustion, impacting the availability of applications that rely on it.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2023-22486 originates from a polynomial time complexity issue in the handle_close_bracket function within cmark-gfm versions prior to 0.29.0.gfm.7. This flaw can be exploited to cause unbounded resource exhaustion, potentially leading to a denial of service (DoS) condition. Attackers can craft specific inputs that trigger excessive resource consumption, making the application unresponsive.
How To Fix
Minimum fixed version
0.29.0.gfm.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade cmark-gfmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to limit the size and complexity of Markdown content processed by cmark-gfm. This can help mitigate the risk of resource exhaustion until the package is updated.
Conclusion
The cmark-gfm package has a critical vulnerability that can lead to denial of service due to resource exhaustion. It is essential to update to the patched version to ensure the security and availability of applications using this library. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for cmark-gfm →
FAQ
cmark-gfm is a library for parsing and rendering CommonMark, a widely used Markdown specification. It is designed for high performance and compliance with CommonMark standards.
The vulnerability allows for potential denial of service due to excessive resource consumption when handling specific Markdown inputs.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, the vulnerability has been patched in version 0.29.0.gfm.13-1 of the cmark-gfm package. Updating to this version will resolve the issue.
Exploitation of this vulnerability can lead to denial of service, making applications that rely on cmark-gfm unresponsive and affecting user experience.
References
Related vulnerabilities
Recent vulnerabilities recorded for cmark-gfm.
