Skip to content

Comrak vulnerable to production of excessive output when parsing Markdown (GHSL-2023-048)

Moderate severity GitHub Reviewed Published Mar 28, 2023 in kivikakk/comrak • Updated Mar 28, 2023

Package

cargo comrak (Rust)

Affected versions

< 0.17.0

Patched versions

0.17.0

Description

Impact

comrak is vulnerable to the upstream cmark issue, "Issue revealed by fuzzer". A large number of references in a markdown document can trigger an overly large response.

Patches

0.17.0 contains kivikakk/comrak@70f97f3, which limits reference output to a 100Kb maximum.

Workarounds

n/a

References

References

@kivikakk kivikakk published to kivikakk/comrak Mar 28, 2023
Published to the GitHub Advisory Database Mar 28, 2023
Reviewed Mar 28, 2023
Last updated Mar 28, 2023

Severity

Moderate
5.3
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses

No CWEs

CVE ID

No known CVE

GHSA ID

GHSA-xxmq-4vph-956w

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.