Improper handling of exceptional conditions in Comrak - CVE-2023-28631

Vulnerability identifier: #VU79723

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-28631

CWE-ID: CWE-755

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper handling of errors when parsing AST. A remote attacker can send specially crafted input and perform a denial of service (DoS) attack.

Comrak
Fedora
rust-askama
rust-askama_shared
rust-comrak

Install updates from vendor's website.

Comrak - update to 0.17.0
rust-askama - addressed in versions 0.11.1-4.fc36, 0.11.1-4.fc37, 0.11.1-4.fc38, 0.11.1-4.fc39
rust-askama_shared - addressed in versions 0.12.2-4.fc36, 0.12.2-4.fc37, 0.12.2-4.fc38, 0.12.2-4.fc39
rust-comrak - addressed in versions 0.18.0-1.fc36, 0.18.0-1.fc37, 0.18.0-1.fc38, 0.18.0-1.fc39

• https://github.com/kivikakk/comrak/commit/9ff5f8df0ac951f5742d22a72c39b89a15f56639
• https://github.com/kivikakk/comrak/security/advisories/GHSA-5r3x-p7xx-x6q5
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTWZWCT7KCX2KTXTLPUYZ3EHOONG4X46/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VQ3UBC7LE4VPCMZBTADIBL353CH7CPVV/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUYME2VA555X6567H7ORIJQFN4BVGT6N/

• Multiple vulnerabilities in Comrak
• Fedora 39 update for rust-askama, rust-askama_shared, rust-comrak
• Fedora 38 update for rust-askama, rust-askama_shared, rust-comrak
• Fedora 37 update for rust-askama, rust-askama_shared, rust-comrak
• Fedora 36 update for rust-askama, rust-askama_shared, rust-comrak