Skip to content

Commit ed6d02c

Browse files
jasnowpostmodern
authored andcommitted
Add 1 advisory I missed previously
1 parent cf528eb commit ed6d02c

File tree

1 file changed

+43
-0
lines changed

1 file changed

+43
-0
lines changed
Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
gem: commonmarker
3+
ghsa: 48wp-p9qv-4j64
4+
url: https://github.com/gjtorikian/commonmarker/releases/tag/v0.23.9
5+
title: Commonmarker vulnerable to to several quadratic complexity bugs
6+
that may lead to denial of service
7+
date: 2023-03-31
8+
description: |
9+
## Impact
10+
11+
Several quadratic complexity bugs in commonmarker's underlying
12+
cmark-gfm library may lead to unbounded resource exhaustion and
13+
subsequent denial of service.
14+
15+
The following vulnerabilities were addressed:
16+
* CVE-2023-24824
17+
* CVE-2023-26485
18+
19+
For more information, consult the release notes for versions
20+
0.23.0.gfm.10 and 0.23.0.gfm.11.
21+
22+
## Mitigation
23+
24+
Users are advised to upgrade to commonmarker version 0.23.9
25+
cvss_v3: 7.5
26+
patched_versions:
27+
- ">= 0.23.9"
28+
related:
29+
cve:
30+
- 2023-24824
31+
- 2023-26485
32+
url:
33+
- https://nvd.nist.gov/vuln/detail/CVE-2023-24824
34+
- https://nvd.nist.gov/vuln/detail/CVE-2023-26485
35+
- https://github.com/gjtorikian/commonmarker/pull/236
36+
- https://rubygems.org/gems/commonmarker/versions/0.23.9
37+
- https://github.com/gjtorikian/commonmarker/releases/tag/v0.23.9
38+
- https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-48wp-p9qv-4j64
39+
- https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59
40+
- https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
41+
- https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5
42+
- https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.10
43+
- https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.11

0 commit comments

Comments
 (0)