A vulnerability, which was classified as problematic, was found in simple-markdown 0.6.0. Affected is an unknown code block of the file simple-markdown.js. The manipulation with the input value <<<<<<<<<<:/:/:/:/:/:/:/:/:/:/ leads to a redos vulnerability. CWE is classifying the issue as CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. This is going to have an impact on availability.

The weakness was presented 02/11/2023 as 73. The advisory is available at github.com. This vulnerability is traded as CVE-2019-25102. Technical details and a public exploit are known. This vulnerability is assigned to T1449.003 by the MITRE ATT&CK project.

The exploit is shared for download at github.com. It is declared as proof-of-concept.

Upgrading to version 0.6.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 015a719bf5cdc561feea05500ecb3274ef609cd2 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version. The advisory contains the following remark:

Patterns like <<<<<<<<<<:/:/:/:/:/:/:/:/:/:/ currently exhibit O(n^3) complexity, allowing a 5KB document to take 7174ms to parse. With this change, it drops to O(n^2) and 73ms.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• simple-markdown

Version

• 0.6.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion