GHSA-8hqf-xjwp-p67vMediumCVSS 5.3

Comrak vulnerable to quadratic runtime issues when parsing Markdown (GHSL-2023-047)

Published
March 28, 2023
Last Modified
May 1, 2023

🔗 CVE IDs covered (1)

CVE-2023-28626 →

📋 Description

Impact

A range of quadratic parsing issues from cmark/cmark-gfm are also present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown.

Patches

0.17.0 contains fixes to known quadratic parsing issues.

Workarounds

n/a

References

  • https://github.com/commonmark/cmark/issues/255
  • https://github.com/commonmark/cmark/issues/389
  • https://github.com/commonmark/cmark/issues/373
  • https://github.com/commonmark/cmark/issues/299
  • https://github.com/commonmark/cmark/issues/388
  • https://github.com/commonmark/cmark/issues/284
  • https://github.com/commonmark/cmark/issues/218
  • https://github.com/commonmark/cmark/pull/232
  • https://github.com/github/cmark-gfm/blob/c32ef78bae851cb83b7ad52d0fbff880acdcd44a/test/pathological_tests.py#L63-L65
  • https://github.com/github/cmark-gfm/blob/c32ef78bae851cb83b7ad52d0fbff880acdcd44a/test/pathological_tests.py#L87-L89

🎯 Affected products1

  • rust/comrak:< 0.17.0

🔗 References (18)