File tree Expand file tree Collapse file tree 1 file changed +43
-0
lines changed Expand file tree Collapse file tree 1 file changed +43
-0
lines changed Original file line number Diff line number Diff line change
1
+ ---
2
+ gem : commonmarker
3
+ ghsa : 48wp-p9qv-4j64
4
+ url : https://github.com/gjtorikian/commonmarker/releases/tag/v0.23.9
5
+ title : Commonmarker vulnerable to to several quadratic complexity bugs
6
+ that may lead to denial of service
7
+ date : 2023-03-31
8
+ description : |
9
+ ## Impact
10
+
11
+ Several quadratic complexity bugs in commonmarker's underlying
12
+ cmark-gfm library may lead to unbounded resource exhaustion and
13
+ subsequent denial of service.
14
+
15
+ The following vulnerabilities were addressed:
16
+ * CVE-2023-24824
17
+ * CVE-2023-26485
18
+
19
+ For more information, consult the release notes for versions
20
+ 0.23.0.gfm.10 and 0.23.0.gfm.11.
21
+
22
+ ## Mitigation
23
+
24
+ Users are advised to upgrade to commonmarker version 0.23.9
25
+ cvss_v3 : 7.5
26
+ patched_versions :
27
+ - " >= 0.23.9"
28
+ related :
29
+ cve :
30
+ - 2023-24824
31
+ - 2023-26485
32
+ url :
33
+ - https://nvd.nist.gov/vuln/detail/CVE-2023-24824
34
+ - https://nvd.nist.gov/vuln/detail/CVE-2023-26485
35
+ - https://github.com/gjtorikian/commonmarker/pull/236
36
+ - https://rubygems.org/gems/commonmarker/versions/0.23.9
37
+ - https://github.com/gjtorikian/commonmarker/releases/tag/v0.23.9
38
+ - https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-48wp-p9qv-4j64
39
+ - https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59
40
+ - https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
41
+ - https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5
42
+ - https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.10
43
+ - https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.11
You can’t perform that action at this time.
0 commit comments