Critical Vulnerability in Pandoc: Integer Overflow Leading to Potential RCE
Summary
RLSA-2022:5597: Important: pandoc security update. Affects pandoc versions < 0:2.0.6-6.el8_6. Fixed in 0:2.0.6-6.el8_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pandoc is a versatile markdown and markup conversion tool widely used for transforming documents between various formats. It supports a multitude of input and output formats, making it a powerful utility for developers and writers alike. The version of Pandoc in Rocky Linux 8 CRB utilizes cmark-gfm, an extended version of the CommonMark implementation, for its conversion processes. This integration, while enhancing functionality, has introduced a critical vulnerability that can lead to severe security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2022-24724, stems from an integer overflow in the table row parsing functionality of cmark-gfm. This flaw can be exploited when parsing tables that contain more than UINT16_MAX columns, potentially resulting in heap memory corruption. Such corruption can lead to remote code execution (RCE), allowing attackers to execute arbitrary code on affected systems. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
0:2.0.6-6.el8_6
This is the first release that contains the fix.
sudo dnf update pandocTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid parsing tables with more than UINT16_MAX columns until the package is updated. This will help mitigate the risk of exploitation until a permanent fix is applied.
Conclusion
The vulnerability in Pandoc, identified as CVE-2022-24724, poses a significant risk due to its potential for remote code execution. Users are strongly advised to update to the patched version to safeguard their systems. Until then, implementing workarounds can help mitigate the risks associated with this vulnerability.
See every vulnerability recorded for pandoc →
FAQ
CVE-2022-24724 is a critical vulnerability in the Pandoc package that arises from an integer overflow in cmark-gfm's table row parsing, potentially leading to remote code execution.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
The primary risk is remote code execution, which allows attackers to execute arbitrary code on affected systems, potentially leading to data breaches or system compromise.
Yes, a patch is available. Update Pandoc to version 0:2.0.6-6.el8_6 to mitigate the vulnerability.
If immediate updating is not possible, avoid parsing tables with more than UINT16_MAX columns to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for pandoc.
