PT-2023-19806 · Cmark-Gfm+5 · Cmark-Gfm+5

Nwellnhof · Publicado 2023-03-31 · Atualizado 2025-12-27 · CVE-2023-24824

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions cmark-gfm versions prior to 0.29.0.gfm.10

Description A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This issue is related to quadratic complexity when parsing text that leads with either large numbers of > or - characters.

Recommendations For versions prior to 0.29.0.gfm.10, upgrade to version 0.29.0.gfm.10 or later to address the issue. For users unable to upgrade, validate that their input comes from trusted sources to minimize the risk of exploitation.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-407

CWE-400

Identificadores relacionados

ALSA-2025:8427

CESA-2025_8427

CVE-2023-24824

GHSA-66G8-4HJF-77XH

HSEC-2025-0007

INFSA-2025_8427

RHSA-2025:8427

RHSA-2025_8427

RSEC-2023-8

Produtos afetados

Almalinux

Centos

Debian

Red Hat

Rocky Linux

Cmark-Gfm

Referências · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24824.json · Exploit
• 🔥 https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh · Exploit
• https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59 · Correção
• https://github.com/r-lib/commonmark/issues/26 · Nota
• https://github.com/haskell/security-advisories · Nota
• https://github.com/kivikakk/cmark-gfm-hs/commit/1359b8740c6b29dde0ad8f816531112b32eb8cbe · Nota
• https://security-tracker.debian.org/tracker/CVE-2023-24824 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-22485 · Aviso do Fabricante
• https://osv.dev/vulnerability/HSEC-2025-0007 · Aviso do Fabricante
• https://errata.almalinux.org/8/ALSA-2025-8427.html · Aviso do Fabricante
• https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export · Nota
• https://t.me/cvenotify/47311 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-24824 · Nota de Segurança
• https://osv.dev/vulnerability/ALSA-2025:8427 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2023-24824 · Nota