CVE-2023-28626: Comrak vulnerable to quadratic runtime issues when parsing Markdown (GHSL-2023-047)
A range of quadratic parsing issues from cmark/cmark-gfm are also present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown.
References
- github.com/advisories/GHSA-8hqf-xjwp-p67v
- github.com/commonmark/cmark/issues/218
- github.com/commonmark/cmark/issues/255
- github.com/commonmark/cmark/issues/284
- github.com/commonmark/cmark/issues/299
- github.com/commonmark/cmark/issues/373
- github.com/commonmark/cmark/issues/388
- github.com/commonmark/cmark/issues/389
- github.com/commonmark/cmark/pull/232
- github.com/github/cmark-gfm/blob/c32ef78bae851cb83b7ad52d0fbff880acdcd44a/test/pathological_tests.py
- github.com/github/cmark-gfm/blob/c32ef78bae851cb83b7ad52d0fbff880acdcd44a/test/pathological_tests.py
- github.com/kivikakk/comrak
- github.com/kivikakk/comrak/commit/ce795b7f471b01589f842dc09af38b025701178d
- github.com/kivikakk/comrak/releases/tag/0.17.0
- github.com/kivikakk/comrak/security/advisories/GHSA-8hqf-xjwp-p67v
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUYME2VA555X6567H7ORIJQFN4BVGT6N
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTWZWCT7KCX2KTXTLPUYZ3EHOONG4X46
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VQ3UBC7LE4VPCMZBTADIBL353CH7CPVV
- nvd.nist.gov/vuln/detail/CVE-2023-28626
Code Behaviors & Features
Detect and mitigate CVE-2023-28626 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →