CVE-2023-22483
Low
Description
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynomial time complexity issues in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically. These vulnerabilities have been patched in version 0.29.0.gfm.7.
SeverityLow
CVSS3.5
Exploit probability—
ProductGithub Cmark-gfm
PublishedJan 23, 2023
First seenJan 23, 2023
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- github cmark-gfm0.29.0.gfm.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github cmark-gfm | v < 0.29.0.gfm.7 | 0.29.0.gfm.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.