PT-2020-18334 · Github+4 · Github Flavored Markdown+4

Jonas Wagner · Published 2020-07-01 · Updated 2023-10-06 · CVE-2020-5238

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GitHub Flavored Markdown versions prior to 0.29.0.gfm.1

Description The issue is related to the time complexity of parsing certain markdown tables, which can take O(n * n) time. An attacker could craft a markdown table to cause a denial of service. This issue does not affect the upstream cmark project.

Recommendations For versions prior to 0.29.0.gfm.1, update to version 0.29.0.gfm.1 to resolve the issue. As a temporary workaround, consider restricting the use of markdown tables until the update is applied.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2021:1972

CESA-2021_1972

CVE-2020-5238

GHSA-7GC6-9QR5-HC85

RHSA-2021:1972

RHSA-2021_1972

RSEC-2023-6

Affected Products

Almalinux

Centos

Debian

Github Flavored Markdown

Red Hat

References · 19

• https://github.com/github/cmark-gfm/commit/85d895289c5ab67f988ca659493a64abb5fec7b4 · Patch
• https://osv.dev/vulnerability/CVE-2020-5238 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:1972 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-5238 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGJH2A4VAV54X6NSCNNGSEIGIIY5N2VR · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCDHBTUFIOYRIS5HAS6PZNBNMB7IOAX3 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-5238 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-5238 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMQFOQQCWOAMQ4I2XIVCVOXXIJ75HDCW · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-5238 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2021-1972.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-5238 · Vendor Advisory
• https://osv.dev/vulnerability/RSEC-2023-6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5238 · Security Note
• https://github.com/github/cmark-gfm/security/advisories/GHSA-7gc6-9qr5-hc85 · Note