PT-2023-25977 · Cmark-Gfm+1 · Cmark-Gfm+1

Kevinbackhouse · Published 2023-07-13 · Updated 2023-10-06 · CVE-2023-37463

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions cmark-gfm versions prior to 0.29.0.gfm.12

Description cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. The issues include polynomial time complexity in multiple components like autolink extension, handle close bracket, and parsing of certain text patterns (leading >, -, ). An out-of-bounds read in the validate protocol function was also identified.

Recommendations For versions prior to 0.29.0.gfm.12, upgrade to version 0.29.0.gfm.12 to patch the vulnerabilities. If upgrading is not possible, validate input from trusted sources to minimize the risk of exploitation. As a temporary workaround, consider restricting the use of the autolink extension, handle close bracket, and parsing of certain text patterns until a patch is available. Avoid using the validate protocol function until the issue is resolved.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2023-37463

GHSA-W4QG-3VF7-M9X5

OPENSUSE-SU-2024:13136-1

RSEC-2023-8

Affected Products

Debian

Cmark-Gfm

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37463.json · Exploit
• 🔥 https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2023-24824 · Vendor Advisory
• https://osv.dev/vulnerability/RSEC-2023-8 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-26485 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22486 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-37463 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-37463 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22484 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-37463 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37463 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-37463 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-37463 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22483 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37463 · Security Note