Source: python-cmarkgfm
X-Debbugs-CC: t...@security.debian.org
Severity: important
Tags: security
Hi,
The following vulnerability was published for python-cmarkgfm.
CVE-2022-39209[0]:
| cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and
| rendering library and program in C. In versions prior to 0.29.0.gfm.6
| a polynomial time complexity issue in cmark-gfm's autolink extension
| may lead to unbounded resource exhaustion and subsequent denial of
| service. Users may verify the patch by running `python3 -c
| 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will
| resource exhaust on unpatched cmark-gfm but render correctly on
| patched cmark-gfm. This vulnerability has been patched in
| 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade
| should disable the use of the autolink extension.
https://github.com/github/cmark-gfm/security/advisories/GHSA-cgh3-p57x-9q7q
https://github.com/github/cmark-gfm/commit/cfcaa0068bf319974fdec283416fcee5035c2d70
(0.29.0.gfm.6)
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2022-39209
https://www.cve.org/CVERecord?id=CVE-2022-39209
Please adjust the affected versions in the BTS as needed.
