PT-2023-21863 · Comrak · Comrak
Darakian
·
Published
2023-03-28
·
Updated
2023-04-29
·
CVE-2023-28631
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
comrak versions prior to 0.17.0
Description
The issue arises when a Comrak AST is constructed manually and then converted to HTML, as the HTML formatting code assumes the AST is well-formed. This assumption can be violated if the AST contains invalid UTF-8 data in its
[u8] fields, potentially triggering several bugs. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.Recommendations
For versions prior to 0.17.0, upgrade to version 0.17.0 or later, which contains adjustments to the AST to store strings instead of unvalidated byte arrays.
As a temporary workaround for users unable to upgrade, manually validate the UTF-8 correctness of all data when assigning to
&[u8] and Vec<u8> fields in the AST.Exploit
Fix
Improper Handling of Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Comrak