PT-2021-17146 · Markdown2+1 · Markdown2+1

Ben Caller · Published 2021-03-03 · Updated 2024-07-12 · CVE-2021-26813

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: markdown2 versions 1.0.1.18 through 2.3.x

Description: The issue allows an attacker to cause a denial of service by providing a malicious string, making markdown2 processing difficult or delayed for an extended period. This occurs due to a regular expression denial of service vulnerability.

Recommendations: For markdown2 versions 1.0.1.18 through 2.3.x, update to version 2.4.0 to resolve the issue.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2021-26813

GHSA-JR9P-R423-9M2R

OPENSUSE-SU-2021:0429-1

OPENSUSE-SU-2021:0451-1

OPENSUSE-SU-2021_0429-1

OPENSUSE-SU-2024:11237-1

OPENSUSE-SU-2024:14146-1

PYSEC-2021-20

Affected Products

Suse

Markdown2

References · 32

• 🔥 https://github.com/trentm/python-markdown2/pull/387 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J752422YELXLMLZJPVJVKD2KKHHQRVEH · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/J752422YELXLMLZJPVJVKD2KKHHQRVEH · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTIX5UXRDJZJ57DO4V33ZNJTNKWGBQLY · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/BRP5RN35JZTSJ3JT4722F447ZDK7LZS5 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRP5RN35JZTSJ3JT4722F447ZDK7LZS5 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/JTIX5UXRDJZJ57DO4V33ZNJTNKWGBQLY · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0429-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-26813 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26813 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-26813 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jr9p-r423-9m2r · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-20 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11237-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26813 · Security Note