GitHub Advisoryadvisory · RubyGems

GHSA-636f-xm5j-pj9m Several quadratic complexity bugs may lead to denial of service in Commonmarker

MEDIUM Published 2023-01-24 Modified 2023-01-24 Official page ↗
Ecosystem
RubyGems
Packages
commonmarker
Severity
Moderate
Weaknesses
CWE-400
Reviewed
2023-01-24

Affected packages

• RubyGems commonmarker: < 0.23.7 → fixed in 0.23.7

Description

Impact Several quadratic complexity bugs in commonmarker's underlying `cmark-gfm` library may lead to unbounded resource exhaustion and subsequent denial of service. The following vulnerabilities were addressed: • CVE-2023-22483 • CVE-2023-22484 • CVE-2023-22485 • CVE-2023-22486 For more information, consult the release notes for version `0.23.0.gfm.7`. Mitigation Users are advised to upgrade to commonmarker version `0.23.7`.

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References