Denial of Service Vulnerability in Commonmarker
Summary
GHSA-7vh7-fw88-wj87: Several quadratic complexity bugs may lead to denial of service in Commonmarker. Affects commonmarker versions < 0.23.10. Fixed in 0.23.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Commonmarker is a RubyGem package that provides a Markdown parser and renderer. It is commonly used in Ruby applications to convert Markdown syntax into HTML. The package is vulnerable to several quadratic complexity bugs in its underlying cmark-gfm library, which may result in unbounded resource exhaustion and subsequent denial of service.
Vulnerability Detail
The quadratic complexity bugs in Commonmarker's cmark-gfm library can be exploited to cause a denial of service attack. By providing specially crafted input, an attacker can trigger excessive resource consumption, leading to the exhaustion of system resources such as CPU and memory. This can result in degraded performance or even a complete system crash. The vulnerabilities have been assigned CVE-2023-37463.
How To Fix
Minimum fixed version
0.23.10
This is the first release that contains the fix.
gem install commonmarker -v 0.23.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to upgrade to the fixed version of the commonmarker package to mitigate the risk of a denial of service attack.
Conclusion
In conclusion, the Commonmarker package is vulnerable to several quadratic complexity bugs that can lead to denial of service attacks. It is crucial to upgrade to version 0.23.10 of the package to mitigate these vulnerabilities. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for commonmarker →
FAQ
The vulnerabilities can lead to unbounded resource exhaustion and subsequent denial of service, potentially causing system instability or crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you if the vulnerability is present.
The only known mitigation is to upgrade to version 0.23.10 of the commonmarker package. This version includes the necessary fixes to address the vulnerabilities.
No, these vulnerabilities do not directly result in data loss. However, they can cause system instability and potential service disruptions.
Yes, you can find the official security advisory for these vulnerabilities at https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5.
References
Related vulnerabilities
Recent vulnerabilities recorded for commonmarker.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.