PT-2023-18534 · Github+3 · Cmark-Gfm+3

Kevinbackhouse + 1 · Published 2023-01-23 · Updated 2025-03-03 · CVE-2023-22483

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions cmark-gfm versions prior to 0.29.0.gfm.7

Description cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. The issue is related to several polynomial time complexity problems that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically.

Recommendations For versions prior to 0.29.0.gfm.7, upgrade to version 0.29.0.gfm.7 or later to patch the vulnerabilities. If upgrading is not possible, validate input from trusted sources to minimize the risk of exploitation. As a temporary workaround, consider restricting the input size to prevent large values from being piped to cmark-gfm.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-407

Related Identifiers

CVE-2023-22483

GHSA-29G3-96G3-JG6C

RSEC-2023-8

USN-7319-1

Affected Products

Debian

Linuxmint

Ubuntu

Cmark-Gfm

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22483.json · Exploit
• 🔥 https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c · Exploit
• https://security-tracker.debian.org/tracker/CVE-2023-22485 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22484 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7319-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-39209 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-24824 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22486 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22483 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22483 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22483 · Security Note
• https://ubuntu.com/security/CVE-2023-22483 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-22483 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22483 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-26485 · Vendor Advisory