Integer overflow vulnerability in commonmarker RubyGem
Summary
GHSA-c2v4-chx5-vff6: Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fmx4-26r3-wxpf. Affects commonmarker versions 0.0.1 – 2.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The commonmarker RubyGem is a library that provides a Markdown parser and renderer for Ruby applications. It allows developers to parse Markdown documents and convert them into HTML or other formats. The vulnerability affects versions of commonmarker prior to 0.23.4.
Vulnerability Detail
The vulnerability in commonmarker is an integer overflow issue that can be exploited by remote attackers. When parsing tables with marker rows that contain more than UINT16_MAX (65535) columns, an integer overflow can occur. This can lead to heap memory corruption, potentially resulting in an information leak or remote code execution.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to upgrade commonmarker to version 0.23.4 or later. This version includes a fix for the integer overflow issue. Developers can update the gem by running the following command:
gem install commonmarker
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of commonmarker as soon as possible.
Conclusion
The integer overflow vulnerability in commonmarker can have serious security implications, potentially leading to information leaks or remote code execution. It is crucial to upgrade to the latest version of commonmarker (0.23.4 or later) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for commonmarker →
FAQ
CommonMarker is a RubyGem that provides a Markdown parser and renderer for Ruby applications. It allows developers to parse Markdown documents and convert them into HTML or other formats.
Versions of commonmarker prior to 0.23.4 are affected by this vulnerability.
An integer overflow vulnerability occurs when an arithmetic operation results in a value that is too large to be represented by the data type used to store it. In this case, parsing tables with marker rows that contain a large number of columns can trigger an integer overflow.
The integer overflow vulnerability in commonmarker can lead to heap memory corruption, potentially resulting in an information leak or remote code execution. This could allow an attacker to access sensitive information or execute arbitrary code on a vulnerable system.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities, to check if your application is affected. Visit the Vulert playground at Vulert Scanner and upload your manifest file (e.g., package-lock.json) to scan for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for commonmarker.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.