CVE-2023-22484

NameCVE-2023-22484
Descriptioncmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cmark-gfm (PTS)buster0.28.3.gfm.19-3vulnerable
bullseye0.29.0.gfm.0-6vulnerable
bookworm, sid0.29.0.gfm.6-6vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cmark-gfmsource(unstable)(unfixed)

Notes

https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r
check other codebase, python-cmarkgfm, ghostwriter, ruby-commonmarker and r-cran-commonmark

Search for package or bug name: Reporting problems