Source: cmark-gfm
Version: 0.29.0.gfm.3-3
Severity: important
Tags: upstream security
X-Debbugs-Cc: car...@debian.org,t...@security.debian.org
Hi,
The following vulnerability was published for cmark-gfm.
CVE-2022-39209[0]:
| cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and
| rendering library and program in C. In versions prior to 0.29.0.gfm.6
| a polynomial time complexity issue in cmark-gfm's autolink extension
| may lead to unbounded resource exhaustion and subsequent denial of
| service. Users may verify the patch by running `python3 -c
| 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will
| resource exhaust on unpatched cmark-gfm but render correctly on
| patched cmark-gfm. This vulnerability has been patched in
| 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade
| should disable the use of the autolink extension.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2022-39209
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39209
[1]
https://github.com/github/cmark-gfm/commit/cfcaa0068bf319974fdec283416fcee5035c2d70
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
