GHSA-48wp-p9qv-4j64
Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of service
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
0.23.9- Upgrade commonmarker to this version or later
Description
Impact
Several quadratic complexity bugs in commonmarker's underlying cmark-gfm library may lead to unbounded resource exhaustion and subsequent denial of service.
The following vulnerabilities were addressed:
For more information, consult the release notes for version 0.23.0.gfm.10 and 0.23.0.gfm.11.
Mitigation
Users are advised to upgrade to commonmarker version 0.23.9.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| commonmarker | < 0.23.9 |
0.23.9 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
commonmarker RubyGems → 0.23.9
- bundler
bundle update commonmarker # Gemfile: gem "commonmarker", ">= 0.23.9"
References
Packages
Other links
- github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
- github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5
- github.com/gjtorikian/commonmarker/security/advisories/GHSA-48wp-p9qv-4j64
- github.com/gjtorikian/commonmarker/pull/236
- github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.10
- github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.11
- github.com/gjtorikian/commonmarker/releases/tag/v0.23.9
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7vh7-fw88-wj87 Several quadratic complexity bugs may lead to denial of service in Commonmarker | Medium | Also affects commonmarker |
| GHSA-636f-xm5j-pj9m Several quadratic complexity bugs may lead to denial of service in Commonmarker | Medium | Also affects commonmarker |
| GHSA-4qw4-jpp4-8gvp Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service | Medium | Also affects commonmarker |
| GHSA-fmx4-26r3-wxpf Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption | Critical | Also affects commonmarker |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor