GHSA-hjcp-j389-59ff CVE-2015-8854
Regular Expression Denial of Service in marked
- Severity
- 7.5 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 4.42%
- Chance of exploitation in the next 30 days. Higher than 91.35% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1333 Inefficient Regular Expression Complexity
- Fix
0.3.4- Upgrade marked to this version or later
Description
Versions 0.3.3 and earlier of marked are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the em inline rule.
Recommendation
Update to version 0.3.4 or later.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| marked | < 0.3.4 |
0.3.4 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
marked npm → 0.3.4
- npm
npm install marked@0.3.4- yarn
yarn add marked@0.3.4- pnpm
pnpm add marked@0.3.4
Severity breakdown
CVSS 3.0 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-1333: Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
How to prevent it
- Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
- System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
- Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- Implementation: Limit the length of the input that the regular expression will process.
References
Advisories
Packages
Other links
- github.com/chjj/marked/issues/497
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BO2RM…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6BJG…
- support.f5.com/csp/article/K05052081
- npmjs.com/advisories/23
- owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS
- openwall.com/lists/oss-security/2016/04/20/11
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6v9c-7cg6-27q7 Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer | High | Also affects marked |
| GHSA-p9wx-2529-fp83 Marked allows Regular Expression Denial of Service (ReDoS) attacks | Medium | Also affects marked |
| GHSA-5v2h-r2cx-5xgj Inefficient Regular Expression Complexity in marked | High | Also affects marked |
| GHSA-rrrm-qjm4-v8hf Inefficient Regular Expression Complexity in marked | High | Also affects marked |
| GHSA-4r62-v4vq-hr96 Regular Expression Denial of Service (REDoS) in Marked | High | Also affects marked |
| GHSA-ch52-vgq2-943f Regular Expression Denial of Service in marked | Low | Also affects marked |
| GHSA-9cw2-jqp5-7x39 Multiple Content Injection Vulnerabilities in marked | Medium | Also affects marked |
| GHSA-xf5p-87ch-gxw2 Marked ReDoS due to email addresses being evaluated in quadratic time | Medium | Also affects marked |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor