PT-2023-33076 · Cmark+1 · Cmark+1

Published 2023-03-28 · Updated 2023-03-28

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions comrak versions prior to 0.17.0

Description The issue is related to an overly large response triggered by a large number of references in a markdown document. This is due to an upstream cmark issue.

Recommendations For versions prior to 0.17.0, update to version 0.17.0, which limits reference output to a 100Kb maximum.

Fix

Related Identifiers

GHSA-XXMQ-4VPH-956W

Affected Products

Cmark

Comrak

References · 6

• https://osv.dev/vulnerability/GHSA-xxmq-4vph-956w · Vendor Advisory
• https://github.com/commonmark/cmark/issues/354 · Note
• https://github.com/kivikakk/comrak/releases/tag/0.17.0 · Note
• https://github.com/kivikakk/comrak/commit/70f97f3ea4eae30ffbd1b94c764a3de2f1c41d2a · Note
• https://github.com/kivikakk/comrak · Note
• https://github.com/kivikakk/comrak/security/advisories/GHSA-xxmq-4vph-956w · Note