GHSA-7vh7-fw88-wj87
Several quadratic complexity bugs may lead to denial of service in Commonmarker
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-407 Inefficient Algorithmic Complexity
- Fix
0.23.10- Upgrade commonmarker to this version or later
Description
Impact
Several quadratic complexity bugs in commonmarker's underlying cmark-gfm library may lead to unbounded resource exhaustion and subsequent denial of service.
The following vulnerabilities were addressed:
For more information, consult the release notes for version 0.29.0.gfm.12.
Mitigation
Users are advised to upgrade to commonmarker version 0.23.10.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| commonmarker | < 0.23.10 |
0.23.10 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
commonmarker RubyGems → 0.23.10
- bundler
bundle update commonmarker # Gemfile: gem "commonmarker", ">= 0.23.10"
Weakness
CWE-407: Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-48wp-p9qv-4j64 Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of service | Medium | Also affects commonmarker |
| GHSA-636f-xm5j-pj9m Several quadratic complexity bugs may lead to denial of service in Commonmarker | Medium | Also affects commonmarker |
| GHSA-4qw4-jpp4-8gvp Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service | Medium | Also affects commonmarker |
| GHSA-fmx4-26r3-wxpf Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption | Critical | Also affects commonmarker |
| GHSA-2qm8-x737-gmw5 pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding | High | Same weakness, CWE-407 |
| GHSA-mm57-4v3p-rchx pyasn1 has quadratic-complexity denial of service in binary REAL decoding | High | Same weakness, CWE-407 |
| GHSA-9m75-vc3g-4x39 pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding | High | Same weakness, CWE-407 |
| GHSA-fm9c-5rcf-2q5p pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding | High | Same weakness, CWE-407 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor