PT-2023-28606 · Unknown+1 · Gomarkdown/Markdown+1

Nsecho · Published 2023-09-22 · Updated 2023-09-26 · CVE-2023-42821

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions github.com/gomarkdown/markdown versions prior to 0.0.0-20230922105210-14b16010c2ee

Description The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Parsing malformed markdown input with a parser that uses the parser.Mmark extension could result in an out-of-bounds read issue. To exploit this, the parser needs to have the parser.Mmark extension set. The issue occurs inside the citation.go file on line 69 when the parser tries to access an element past its length, resulting in a denial of service.

Recommendations For versions prior to 0.0.0-20230922105210-14b16010c2ee, update to a version that includes the patch for this issue, such as 0.0.0-20230922105210-14b16010c2ee or later. As a temporary workaround, consider disabling the parser.Mmark extension until a patch is applied.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

AZL-39828

CVE-2023-42821

GHSA-M9XQ-6H2J-65R2

GO-2023-2074

Affected Products

Debian

Gomarkdown/Markdown

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42821.json · Exploit
• 🔥 https://github.com/gomarkdown/markdown/security/advisories/GHSA-m9xq-6h2j-65r2 · Exploit
• https://github.com/gomarkdown/markdown/commit/14b16010c2ee7ff33a940a541d993bd043a88940 · Patch
• https://security-tracker.debian.org/tracker/CVE-2023-42821 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-42821 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-42821 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42821 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-42821 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m9xq-6h2j-65r2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-42821 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2074 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-39828 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-42821 · Vendor Advisory
• https://github.com/gomarkdown/markdown · Note
• https://github.com/gomarkdown/markdown/blob/7478c230c7cd3e7328803d89abe591d0b61c41e4/parser/citation.go#L69 · Note