PT-2017-4256 · Marked · Marked

Published 2017-09-07 · Updated 2019-10-09 · CVE-2017-16114

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions marked versions prior to 0.3.9

Description The issue is related to incorrect handling of regular expressions in the marked module, which can lead to a denial of service. This can cause the event loop to be blocked, with significant amplification - 1,000 characters can result in a blockage of around 6 seconds.

Recommendations Update to version 0.3.9 or later. As a temporary workaround, consider restricting the input size to prevent excessive blocking of the event loop until a patch is available.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1333

CWE-400

CWE-186

Related Identifiers

BDU:2023-07555

CVE-2017-16114

GHSA-X5PG-88WF-QQ4P

Affected Products

Marked

References · 17

• 🔥 https://github.com/chjj/marked/issues/937 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-16114 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16114 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-16114 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-16114 · Security Note
• https://ubuntu.com/security/CVE-2017-16114 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16114 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16114 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07555 · Security Note
• https://osv.dev/vulnerability/GHSA-x5pg-88wf-qq4p · Vendor Advisory
• https://github.com/markedjs/marked/pull/945 · Note
• https://security.snyk.io/vuln/npm:marked:20170907 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16114 · Note
• https://nodesecurity.io/advisories/531 · Note
• https://vuldb.com/de/?id.119081 · Note