GHSA-xxmq-4vph-956w
Comrak vulnerable to production of excessive output when parsing Markdown (GHSL-2023-048)
- Severity
- 5.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
0.17.0- Upgrade comrak to this version or later
Description
Impact
comrak is vulnerable to the upstream cmark issue, "Issue revealed by fuzzer". A large number of references in a markdown document can trigger an overly large response.
Patches
0.17.0 contains https://github.com/kivikakk/comrak/commit/70f97f3ea4eae30ffbd1b94c764a3de2f1c41d2a, which limits reference output to a 100Kb maximum.
Workarounds
n/a
References
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| comrak | < 0.17.0 |
0.17.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
comrak crates.io → 0.17.0
- cargo
cargo update -p comrak --precise 0.17.0
Severity breakdown
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
References
Packages
Other links
Timeline
- Published
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-5r3x-p7xx-x6q5 Comrak AST node data is not validated (GHSL-2023-049) | Critical | Also affects comrak |
| GHSA-8hqf-xjwp-p67v Comrak vulnerable to quadratic runtime issues when parsing Markdown (GHSL-2023-047) | High | Also affects comrak |
| GHSA-6wj2-g87r-pm62 Cross-site Scripting in comrak | Medium | Also affects comrak |
| GHSA-xmr7-v725-2jjr Cross site scripting in comrak | Medium | Also affects comrak |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor