PT-2018-6518 · Npm · Marked

Published 2017-12-08 · Updated 2018-02-06 · CVE-2017-17461

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: marked versions prior to the version where the issue was fixed

Description: A Regular expression Denial of Service (ReDoS) issue in the marked.js file of the marked npm package allows a remote attacker to overload and crash a server by passing a maliciously crafted string.

Recommendations: For marked versions prior to the version where the issue was fixed, update to a version where the ReDoS vulnerability in the marked.js file has been addressed.

Related Identifiers

CVE-2017-17461

GHSA-CRMX-V835-HCP4

Affected Products

Marked

References · 7

• https://ubuntu.com/security/CVE-2017-17461 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-17461 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17461 · Security Note
• https://osv.dev/vulnerability/GHSA-crmx-v835-hcp4 · Vendor Advisory
• https://checkmarx.com/advisories/regular-expression-denial-service-redos-vulnerability-marked-npm-package · Note
• https://github.com/advisories/GHSA-crmx-v835-hcp4 · Note