Denial of Service Vulnerability in Commonmarker
Summary
GHSA-636f-xm5j-pj9m: Several quadratic complexity bugs may lead to denial of service in Commonmarker. Affects commonmarker versions < 0.23.7. Fixed in 0.23.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Commonmarker is a RubyGem package that provides a Markdown parser and renderer. It is commonly used in Ruby applications to parse and render Markdown content. However, several quadratic complexity bugs have been discovered in the underlying cmark-gfm library, which is used by Commonmarker. These bugs can lead to unbounded resource exhaustion and subsequent denial of service.
Vulnerability Detail
The quadratic complexity bugs in cmark-gfm library can be exploited by an attacker to cause a denial of service. By crafting specially crafted Markdown content, an attacker can trigger the quadratic complexity behavior, causing the parser to consume excessive resources and potentially crash the application. This vulnerability has been assigned several CVE identifiers: CVE-2023-22483, CVE-2023-22484, CVE-2023-22485, and CVE-2023-22486.
How To Fix
Minimum fixed version
0.23.7
This is the first release that contains the fix.
gem install commonmarker -v 0.23.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Commonmarker as soon as possible.
Conclusion
In conclusion, the Commonmarker RubyGem is vulnerable to denial of service attacks due to quadratic complexity bugs in the underlying cmark-gfm library. It is crucial to upgrade to version 0.23.7 of Commonmarker to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for commonmarker →
FAQ
Commonmarker is a RubyGem package that provides a Markdown parser and renderer. It is commonly used in Ruby applications to parse and render Markdown content.
The vulnerability can lead to denial of service, as an attacker can craft malicious Markdown content to trigger the quadratic complexity bugs and consume excessive resources.
To fix this vulnerability, you should upgrade to version 0.23.7 of the Commonmarker RubyGem.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Commonmarker.
There are no known exploits for this vulnerability at the moment.
References
Related vulnerabilities
Recent vulnerabilities recorded for commonmarker.
