cmark-gfm prior 0.29.0.gfm.10 CommonMark Parsing ~/cmark-gfm$ algorithmic complexity

Summaryinfo

A vulnerability, which was classified as problematic, has been found in cmark-gfm. This issue affects some unknown processing of the file ~/cmark-gfm$ of the component CommonMark Parsing. This manipulation causes algorithmic complexity. This vulnerability is handled as CVE-2023-26485. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in cmark-gfm. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file ~/cmark-gfm$ of the component CommonMark Parsing. The manipulation with an unknown input leads to a algorithmic complexity vulnerability. The CWE definition for the vulnerability is CWE-407. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached. As an impact it is known to affect availability. The summary by CVE is:

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `_` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources. ### Impact A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. ### Proof of concept ``` $ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad, end="")' | time ./build/src/cmark-gfm --to plaintext ``` Increasing the number 10000 in the above commands causes the running time to increase quadratically. ### Patches This vulnerability have been patched in 0.29.0.gfm.10. ### Note on cmark and cmark-gfm XXX: TBD [cmark-gfm](https://github.com/github/cmark-gfm) is a fork of [cmark](https://github.com/commonmark/cmark) that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both `cmark` and `cmark-gfm`. ### Credit We would like to thank @gravypod for reporting this vulnerability. ### References https://en.wikipedia.org/wiki/Time_complexity ### For more information If you have any questions or comments about this advisory: * Open an issue in [github/cmark-gfm](https://github.com/github/cmark-gfm)

The weakness was released 04/01/2023 as GHSA-r8vr-c48j-fcc5. The advisory is shared at github.com. This vulnerability is known as CVE-2023-26485 since 02/23/2023. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 218384 (Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : cmark-gfm vulnerabilities (USN-7319-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.29.0.gfm.10 eliminates this vulnerability. Applying the patch 07a66c9bc341f902878e37d7da8647d6ef150987 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (218384). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• cmark-gfm

Version

• 0.28.3.gfm.21
• 0.29.0.gfm.3
• 0.29.0.gfm.6
• 0.29.0.gfm.7

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion