PT-2023-33076 · Cmark+1 · Cmark+1

Publicado 2023-03-28 · Atualizado 2023-03-28

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions comrak versions prior to 0.17.0

Description The issue is related to an overly large response triggered by a large number of references in a markdown document. This is due to an upstream cmark issue.

Recommendations For versions prior to 0.17.0, update to version 0.17.0, which limits reference output to a 100Kb maximum.

Correção

Identificadores relacionados

GHSA-XXMQ-4VPH-956W

Produtos afetados

Cmark

Comrak

Referências · 6

• https://github.com/commonmark/cmark/issues/354 · Nota
• https://github.com/kivikakk/comrak/releases/tag/0.17.0 · Nota
• https://github.com/kivikakk/comrak/commit/70f97f3ea4eae30ffbd1b94c764a3de2f1c41d2a · Nota
• https://github.com/kivikakk/comrak · Nota
• https://github.com/kivikakk/comrak/security/advisories/GHSA-xxmq-4vph-956w · Nota
• https://osv.dev/vulnerability/GHSA-xxmq-4vph-956w · Aviso do Fabricante