Resource exhaustion in Comrak - CVE-2023-28626

Vulnerability identifier: #VU79722

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-28626

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Comrak
Fedora
rust-askama
rust-askama_shared
rust-comrak

Install updates from vendor's website.

Comrak - update to 0.17.0
rust-askama - addressed in versions 0.11.1-4.fc36, 0.11.1-4.fc37, 0.11.1-4.fc38, 0.11.1-4.fc39
rust-askama_shared - addressed in versions 0.12.2-4.fc36, 0.12.2-4.fc37, 0.12.2-4.fc38, 0.12.2-4.fc39
rust-comrak - addressed in versions 0.18.0-1.fc36, 0.18.0-1.fc37, 0.18.0-1.fc38, 0.18.0-1.fc39

• https://github.com/kivikakk/comrak/commit/ce795b7f471b01589f842dc09af38b025701178d
• https://github.com/kivikakk/comrak/security/advisories/GHSA-8hqf-xjwp-p67v
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTWZWCT7KCX2KTXTLPUYZ3EHOONG4X46/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VQ3UBC7LE4VPCMZBTADIBL353CH7CPVV/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUYME2VA555X6567H7ORIJQFN4BVGT6N/

• Multiple vulnerabilities in Comrak
• Fedora 39 update for rust-askama, rust-askama_shared, rust-comrak
• Fedora 38 update for rust-askama, rust-askama_shared, rust-comrak
• Fedora 37 update for rust-askama, rust-askama_shared, rust-comrak
• Fedora 36 update for rust-askama, rust-askama_shared, rust-comrak