PT-2015-3416 · Marked · Marked

CVE-2015-8854 · Published 2015-01-22 · Updated 2024-02-09

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions marked versions 0.3.3 and earlier

Description The issue is related to errors in resource management, allowing a remote attacker to cause a denial of service. This can be achieved through unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," also known as a "regular expression denial of service (ReDoS)." The estimated number of potentially affected devices worldwide is not provided. There is no information about real-world incidents where this issue was exploited.

Recommendations Update to version 0.3.4 or later. As a temporary workaround, consider restricting the use of the em inline rule in the marked package until a patch is available. Avoid using inputs that may trigger the "catastrophic backtracking issue" in the affected versions.

Fix

DoS

Weakness Enumeration

CWE-399

CWE-1333

Related Identifiers

BDU:2022-01720

CVE-2015-8854

GHSA-HJCP-J389-59FF

Affected Products

Marked

References · 28

• https://bdu.fstec.ru/vul/2022-01720 · Security Note
• https://osv.dev/vulnerability/CVE-2015-8854 · Vendor Advisory
• https://nodesecurity.io/advisories/23 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8854 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-8854 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8854 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BO2RMVVZVV6NFTU46B5RYRK7ZCXYARZS · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/BO2RMVVZVV6NFTU46B5RYRK7ZCXYARZS · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/M6BJG6RGDH7ZWVVAUFBFI5L32RSMQN2S · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6BJG6RGDH7ZWVVAUFBFI5L32RSMQN2S · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hjcp-j389-59ff · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8854 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-8854 · Security Note
• https://ubuntu.com/security/CVE-2015-8854 · Vendor Advisory
• https://github.com/chjj/marked · Note