cmark-gfm: CVE-2023-24824 Unbounded Resource Exhaustion (DOS) before v0.29
CVE-2023-24824 Published on March 31, 2023
Quadratic complexity may lead to a denial of service in cmark-gfm
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.
Vulnerability Analysis
CVE-2023-24824 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.
Weakness Types
What is a Resource Exhaustion Vulnerability?
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVE-2023-24824 has been classified to as a Resource Exhaustion vulnerability or weakness.
Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Products Associated with CVE-2023-24824
Want to know whenever a new CVE is published for github Cmark Gfm? stack.watch will email you.
Affected Versions
github cmark-gfm Version < 0.29.0.gfm.10 is affected by CVE-2023-24824Vulnerable Packages
The following package name and versions may be associated with CVE-2023-24824
| Package Manager | Vulnerable Package | Versions | Fixed In |
|---|---|---|---|
| rubygems | commonmarker | < 0.23.9 | 0.23.9 |
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.