Out-of-Bounds Read Vulnerability in golang-github-gomarkdown-markdown Package
Summary
UBUNTU-CVE-2023-42821: The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Affects golang-github-gomarkdown-markdown versions 0.0~git20220731.dcdaee8-2 – 0.0~git20231115.a660076-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang-github-gomarkdown-markdown package is a Go library designed for parsing Markdown text and rendering it as HTML. It is widely used for its efficiency and ease of integration in applications that require Markdown processing. However, this package has a vulnerability that can lead to serious issues if not addressed, particularly when using the parser.Mmark extension.
Vulnerability Detail
The vulnerability arises from an out-of-bounds read condition that occurs when parsing malformed Markdown input with the parser.Mmark extension enabled. Specifically, the issue is triggered in the citation.go file at line 69, where the parser attempts to access an element beyond its allocated length. This can lead to a denial of service, as the application may panic and crash, impacting availability. The vulnerability affects versions prior to pseudoversion 0.0.0-20230922105210-14b16010c2ee, which includes a patch for this issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot update the package immediately, consider disabling the parser.Mmark extension in your application to mitigate the risk of exploitation until you can apply the patch.
Conclusion
The golang-github-gomarkdown-markdown package has a critical out-of-bounds read vulnerability that can lead to denial of service. It is crucial to update to the patched version to ensure the security and stability of applications using this library. Users should also consider using tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for golang-github-gomarkdown-markdown →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. You can check your application using the Vulert playground at Vulert Scanner without any signup.
Exploiting this vulnerability can lead to a denial of service, causing the application to crash and become unavailable to users.
Yes, the patched version corresponds to pseudoversion 0.0.0-20230922105210-14b16010c2ee, which includes the necessary fix for the vulnerability.
If an immediate update is not possible, disable the parser.Mmark extension in your application to reduce the risk of exploitation until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for golang-github-gomarkdown-markdown.
