CVE-2023-22485 — Out-of-bounds Read in Github Cmark-gfm

CWE-125 — Out-of-bounds ReadCWE-91 — XML Injection (aka Blind XPath Injection)CWE-400 — Uncontrolled Resource Consumption5 documents4 sources
Severity
5.3MEDIUMNVD
GHSA7.5OSV7.5
EPSS
0.1%
top 78.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Github Cmark-gfmDebian Cmark-gfmDebian Python-cmarkgfm+2 more
Timeline
PublishedJan 24

Description

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages6 packages

▶NVDgithub/cmark-gfm< 0.29.0.gfm.7
▶Debiangithub/cmark-gfm< 0.29.0.gfm.13-1+1
▶debiandebian/cmark-gfm< cmark-gfm 0.29.0.gfm.13-1 (forky)
▶debiandebian/python-cmarkgfm< cmark-gfm 0.29.0.gfm.13-1 (forky)
▶debiandebian/r-cran-commonmark< cmark-gfm 0.29.0.gfm.13-1 (forky)

🔴Vulnerability Details

3
OSV
CVE-2023-22485: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C↗2023-01-24
▶
OSV
Several quadratic complexity bugs may lead to denial of service in Commonmarker↗2023-01-24
▶
GHSA
Several quadratic complexity bugs may lead to denial of service in Commonmarker↗2023-01-24
▶

📋Vendor Advisories

1
Debian
CVE-2023-22485: cmark-gfm - cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library ...↗2023
▶