CVE-2021-26813: markdown2 Regular Expression Denial of Service Vulnerability
Summary
CVE-2021-26813: markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. Affects markdown2 versions >= 1.0.1.18, < 2.4.0. Fixed in 2.4.0. How to fix ↓
Also tracked for
- python-markdown2 · Debian:11
The same CVE-2021-26813 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
markdown2 is a Python library that converts Markdown text into HTML. It is widely used for rendering Markdown content in various applications. However, versions prior to 2.4.0 are affected by a regular expression denial of service (ReDoS) vulnerability. This vulnerability can be exploited by an attacker who provides a malicious string, causing markdown2 processing to become difficult or delayed for an extended period of time.
Vulnerability Detail
The regular expression denial of service vulnerability in markdown2 arises due to inefficient regular expressions used in the library. When a specially crafted input string is provided, the regular expression engine can enter into an exponential time complexity, leading to a denial of service condition. This can result in excessive CPU usage and prolonged processing time, potentially impacting the availability of the application or system utilizing markdown2.
How To Fix
Minimum fixed version
2.4.0
This is the first release that contains the fix.
pip install --upgrade "markdown2==2.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by sanitizing user input and limiting the complexity of the Markdown content. This can be achieved by implementing input validation and filtering mechanisms to prevent the submission of malicious or excessively complex strings. Additionally, rate limiting or timeout mechanisms can be employed to mitigate the impact of potential denial of service attacks.
Conclusion
The markdown2 library prior to version 2.4.0 is vulnerable to a regular expression denial of service attack. Upgrading to the latest version or applying the recommended workarounds can mitigate the risk of exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for markdown2 →
FAQ
markdown2 is a Python library used for converting Markdown text into HTML. It is commonly used in applications for rendering Markdown content.
The vulnerability allows an attacker to cause markdown2 processing to become difficult or delayed, potentially leading to a denial of service condition. This can impact the availability of the application or system utilizing markdown2.
To fix this vulnerability, it is recommended to upgrade markdown2 to version 2.4.0 or later. This version includes improvements to the regular expressions used in the library, mitigating the risk of a denial of service attack.
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by sanitizing user input and limiting the complexity of the Markdown content. Input validation, filtering, rate limiting, and timeout mechanisms can help mitigate the impact of potential denial of service attacks.
You can find more information about this vulnerability in the official advisory database of the Python Packaging Authority (PyPA). The source link for this vulnerability is provided in the advisory details.
Related vulnerabilities
Recent vulnerabilities recorded for markdown2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
