GitHub Advisoryadvisory · crates.io

GHSA-8hqf-xjwp-p67v Comrak vulnerable to quadratic runtime issues when parsing Markdown (GHSL-2023-047)

MEDIUM Published 2023-03-28 Modified 2023-03-28 Official page ↗

Aliases: CVE-2023-28626
Ecosystem: crates.io
Packages: comrak
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses: CWE-400
Reviewed: 2023-03-28

Affected packages

• crates.io comrak: < 0.17.0 → fixed in 0.17.0

Description

Impact A range of quadratic parsing issues from `cmark`/`cmark-gfm` are also present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown. Patches 0.17.0 contains fixes to known quadratic parsing issues. Workarounds n/a References • https://github.com/commonmark/cmark/issues/255 • https://github.com/commonmark/cmark/issues/389 • https://github.com/commonmark/cmark/issues/373 • https://github.com/commonmark/cmark/issues/299 • https://github.com/commonmark/cmark/issues/388 • https://github.com/commonmark/cmark/issues/284 • https://github.com/commonmark/cmark/issues/218 • https://github.com/commonmark/cmark/pull/232 • https://github.com/github/cmark-gfm/blob/c32ef78bae851cb83b7ad52d0fbff880acdcd44a/test/pathological_tests.py#L63-L65 • https://github.com/github/cmark-gfm/blob/c32ef78bae851cb83b7ad52d0fbff880acdcd44a/test/pathological_tests.py#L87-L89

Related

Alias · CVE (1)

CVE-2023-28626 comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. vulnerability

Weakness · CWE (1)

CWE-400 Uncontrolled Resource Consumption weakness

References