PT-2022-7078 · Marked+1 · Marked+1

Makenowjust + 1 · Published 2022-01-13 · Updated 2023-07-24 · CVE-2022-21680

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Marked versions prior to 4.0.10

Description The issue is related to the regular expression block.def which may cause catastrophic backtracking against some strings, leading to a regular expression denial of service (ReDoS). This can affect anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit.

Recommendations For versions prior to 4.0.10, upgrade to version 4.0.10 to resolve the issue. As a temporary workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1333

CWE-186

CWE-400

Related Identifiers

BDU:2023-07521

CVE-2022-21680

GHSA-RRRM-QJM4-V8HF

Affected Products

Debian

Marked

References · 21

• 🔥 https://github.com/markedjs/marked/security/advisories/GHSA-rrrm-qjm4-v8hf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21680.json · Exploit
• https://github.com/markedjs/marked/commit/c4a3ccd344b6929afa8a1d50ac54a721e57012c0 · Patch
• https://ubuntu.com/security/CVE-2022-21680 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rrrm-qjm4-v8hf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21680 · Security Note
• https://bdu.fstec.ru/vul/2023-07521 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-21680 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-21680 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-21680 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21680 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21680 · Vendor Advisory
• https://github.com/markedjs/marked · Note