rsec-2023-8

osv_cran
Description

cmark-gfm, GitHub's extended version of the CommonMark library in C, suffers from multiple vulnerabilities affecting versions prior to 0.29.0.gfm.12. Various issues, including polynomial time complexity in multiple components like autolink extension, handle_close_bracket, and parsing of certain text patterns (leading `>`, `-`, `_`), may lead to unbounded resource exhaustion and denial of service. An out-of-bounds read in the `validate_protocol` function was also identified but is considered less harmful. Patches are available in versions 0.29.0.gfm.7, 0.29.0.gfm.10, and 0.29.0.gfm.12. Upgrading is advised, and users unable to upgrade should validate input from trusted sources.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "affected": [
    {
      "database_specific": {
        "source": "https://github.com/RConsortium/r-advisory-database/blob/main/vulns/commonmark/RSEC-2023-8.yaml"
      },
      "package": {
        "ecosystem": "CRAN",
        "name": "commonmark",
        "purl": "pkg:cran/commonmark"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.2"
            },
            {
              "fixed": "1.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.2",
        "0.4",
        "0.5",
        "0.6",
        "0.7",
        "0.8",
        "0.9",
        "1.0",
        "1.1",
        "1.2",
        "1.4",
        "1.5",
        "1.6",
        "1.7",
        "1.8",
        "1.9",
        "1.9.1",
        "1.8.0",
        "1.8.1",
        "1.9.0"
      ]
    }
  ],
  "details": "cmark-gfm, GitHub's extended version of the CommonMark library in C, suffers from multiple vulnerabilities affecting versions prior to 0.29.0.gfm.12. Various issues, including polynomial time complexity in multiple components like autolink extension, handle_close_bracket, and parsing of certain text patterns (leading `>`, `-`, `_`), may lead to unbounded resource exhaustion and denial of service. An out-of-bounds read in the `validate_protocol` function was also identified but is considered less harmful. Patches are available in versions 0.29.0.gfm.7, 0.29.0.gfm.10, and 0.29.0.gfm.12. Upgrading is advised, and users unable to upgrade should validate input from trusted sources.",
  "id": "RSEC-2023-8",
  "modified": "2025-05-19T19:43:48.265479Z",
  "published": "2023-10-06T05:00:00.600Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2023-37463"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2023-26485"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2023-24824"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2023-22486"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2023-22485"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2023-22484"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2023-22483"
    },
    {
      "type": "WEB",
      "url": "https://github.com/r-lib/commonmark/issues/26"
    }
  ],
  "schema_version": "1.7.3",
  "summary": "Denial of Service (DoS) vulnerabilities",
  "upstream": [
    "CVE-2023-22483",
    "CVE-2023-22484",
    "CVE-2023-22485",
    "CVE-2023-22486",
    "CVE-2023-24824",
    "CVE-2023-26485",
    "CVE-2023-37463"
  ]
}
View JSON API Download JSON