PT-2023-18537 · Cmark-Gfm+4 · Cmark-Gfm+4

Anticomputer · Published 2023-01-24 · Updated 2025-03-03 · CVE-2023-22486

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions cmark-gfm versions prior to 0.29.0.gfm.12

Description The issue concerns a polynomial time complexity problem in multiple components, including the autolink extension, handle close bracket, and parsing of certain text patterns, which may lead to unbounded resource exhaustion and subsequent denial of service. An out-of-bounds read in the validate protocol function was also identified.

Recommendations For versions prior to 0.29.0.gfm.7, update to version 0.29.0.gfm.7 or later to resolve the issue. For versions prior to 0.29.0.gfm.10, update to version 0.29.0.gfm.10 or later to ensure all patches are applied. For versions prior to 0.29.0.gfm.12, update to version 0.29.0.gfm.12 to apply the latest security patches. As a temporary workaround, consider validating input from trusted sources if upgrading is not immediately possible.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-407

Related Identifiers

CVE-2023-22486

GHSA-R572-JVJ2-3M8P

MGASA-2023-0181

OPENSUSE-SU-2024:12802-1

RSEC-2023-8

SUSE-SU-2023:1834-1

SUSE-SU-2023_1834-1

USN-7319-1

Affected Products

Debian

Linuxmint

Suse

Ubuntu

Cmark-Gfm

References · 34

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22486.json · Exploit
• 🔥 https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p · Exploit
• https://security-tracker.debian.org/tracker/CVE-2023-22485 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22484 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7319-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-39209 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-24824 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22486 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0181.html · Security Note
• https://osv.dev/vulnerability/MGASA-2023-0181 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-22486 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22486 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-22483 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12802-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22486 · Security Note