Quadratic complexity bugs may lead to a denial of service
CVE-2023-37463

6.4MEDIUM

Key Information:

Vendor

Github
Status
Cmark-gfm
Vendor
CVE Published:
13 July 2023

What is CVE-2023-37463?

cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.

Affected Version(s)

cmark-gfm < 0.29.0.gfm.12

References

https://github.com/github/cmark-gfm/security/advisories/G...
x_refsource_CONFIRM
https://github.com/github/cmark-gfm/releases/tag/0.29.0.g...
x_refsource_MISC

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.