CVE-2023-26302: markdown-it-py Denial of Service vulnerability
Summary
CVE-2023-2630: Pimcore Cross-site Scripting (XSS) vulnerability in Admin Translations. Affects pimcore/pimcore versions < 10.5.21. Fixed in 10.5.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
markdown-it-py is a Python package available on PyPI that provides a command line interface for rendering Markdown content. It is widely used for converting Markdown files into HTML or other formats. The package allows users to process Markdown input and generate corresponding output. However, versions prior to v2.2.0 are vulnerable to a Denial of Service (DoS) attack if an attacker is able to input invalid UTF-8 characters.
Vulnerability Detail
The vulnerability in markdown-it-py allows an attacker to cause a DoS attack by providing invalid UTF-8 characters as input through the command line interface. This vulnerability can lead to the unavailability of the application, affecting its functionality and potentially disrupting the workflow of users. It is important to note that this vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
10.5.21
This is the first release that contains the fix.
composer require pimcore/pimcore:10.5.21Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The markdown-it-py package, before version 2.2.0, is vulnerable to a Denial of Service (DoS) attack through the command line interface. It is crucial to update the package to version 2.2.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pimcore/pimcore →
FAQ
markdown-it-py is a Python package that provides a command line interface for rendering Markdown content.
This vulnerability can lead to a Denial of Service (DoS) attack, causing the application to become unavailable and potentially disrupting user workflows.
This vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
To fix this vulnerability, update markdown-it-py to version 2.2.0 or later by running the command: pip install --upgrade markdown-it-py.
No specific workaround has been mentioned for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/pimcore.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
