Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 2128044 (CVE-2022-39209) - CVE-2022-39209 cmark-gfm: Unbounded resource exhaustion may lead to denial of service
Summary: CVE-2022-39209 cmark-gfm: Unbounded resource exhaustion may lead to denial of...
Keywords:
Status: NEW
Alias: CVE-2022-39209
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2128048 2128045 2128046 2128047 2128050 2139273
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-09-19 17:37 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-09-05 12:18 UTC (History)
7 users (show)

Fixed In Version: cmark-gfm 0.29.0.gfm.6
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2022-09-19 17:37:07 UTC 
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.

Reference:
https://github.com/github/cmark-gfm/security/advisories/GHSA-cgh3-p57x-9q7q

Upstream patch:
https://github.com/github/cmark-gfm/commit/9d57d8a23142b316282bdfc954cb0ecda40a8655
Comment 1 Guilherme de Almeida Suckevicz 2022-09-19 17:37:33 UTC 
Created ghc-cmark-gfm tracking bugs for this issue:

Affects: fedora-all [bug 2128045]


Created ghostwriter tracking bugs for this issue:

Affects: fedora-all [bug 2128046]


Created python-cmarkgfm tracking bugs for this issue:

Affects: epel-8 [bug 2128048]
Affects: fedora-all [bug 2128047]
Comment 3 Jens Petersen 2022-09-21 09:39:20 UTC 
For ghc-cmark-gfm I opened https://github.com/kivikakk/cmark-gfm-hs/issues/24
Note You need to log in before you can comment on or make changes to this bug.