PT-2023-18534 · Github+3 · Cmark-Gfm+3

Kevinbackhouse + 1 · Publicado 2023-01-23 · Atualizado 2025-03-03 · CVE-2023-22483

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Baixa

Vetor base

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions cmark-gfm versions prior to 0.29.0.gfm.7

Description cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. The issue is related to several polynomial time complexity problems that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically.

Recommendations For versions prior to 0.29.0.gfm.7, upgrade to version 0.29.0.gfm.7 or later to patch the vulnerabilities. If upgrading is not possible, validate input from trusted sources to minimize the risk of exploitation. As a temporary workaround, consider restricting the input size to prevent large values from being piped to cmark-gfm.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

CWE-407

Identificadores relacionados

CVE-2023-22483

GHSA-29G3-96G3-JG6C

RSEC-2023-8

USN-7319-1

Produtos afetados

Debian

Linuxmint

Ubuntu

Cmark-Gfm

Referências · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22483.json · Exploit
• 🔥 https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c · Exploit
• https://github.com/r-lib/commonmark/issues/26 · Nota
• https://security-tracker.debian.org/tracker/CVE-2023-22485 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-22484 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-7319-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2022-39209 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-24824 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-22486 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-22483 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22483 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-22483 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-22483 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-22483 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-22483 · Aviso do Fabricante