SB2023040325 - Multiple vulnerabilities in cmark-gfm

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Inefficient Algorithmic Complexity (CVE-ID: CVE-2023-24824)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the polynomial time complexity issue. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

2) Inefficient Algorithmic Complexity (CVE-ID: CVE-2023-26485)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the polynomial time complexity issue. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
• https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59
• https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5
• https://github.com/github/cmark-gfm/commit/07a66c9bc341f902878e37d7da8647d6ef150987