Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/164293?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/164293?format=api", "purl": "pkg:gem/commonmarker@0.9.0", "type": "gem", "namespace": "", "name": "commonmarker", "version": "0.9.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "0.23.10", "latest_non_vulnerable_version": "1.0.0.pre", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51344?format=api", "vulnerability_id": "VCID-43xy-vnf8-kkbj", "summary": "Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service\n### Impact\n\nCommonMarker uses `cmark-gfm` for rendering [Github Flavored\nMarkdown](https://github.github.com/gfm/). A polynomial time complexity issue\nin cmark-gfm's autolink extension may lead to unbounded resource exhaustion\nand subsequent denial of service.\n\n### Patches\n\nThis vulnerability has been patched in the following CommonMarker release:\n\n- v0.23.6\n\n### Workarounds\n\nDisable use of the autolink extension.\n\n### References\nhttps://en.wikipedia.org/wiki/Time_complexity", "references": [ { "reference_url": "https://github.com/gjtorikian/commonmarker", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker" }, { "reference_url": "https://github.com/gjtorikian/commonmarker/pull/190", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker/pull/190" }, { "reference_url": "https://github.com/gjtorikian/commonmarker/releases/tag/v0.23.6", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker/releases/tag/v0.23.6" }, { "reference_url": "https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-4qw4-jpp4-8gvp", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-4qw4-jpp4-8gvp" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/145774?format=api", "purl": "pkg:gem/commonmarker@0.23.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-9q5d-95ws-2uhh" }, { "vulnerability": "VCID-ryey-1gks-fydw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/commonmarker@0.23.6" } ], "aliases": [ "GHSA-4qw4-jpp4-8gvp" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-43xy-vnf8-kkbj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/45800?format=api", "vulnerability_id": "VCID-9q5d-95ws-2uhh", "summary": "Several quadratic complexity bugs may lead to denial of service in Commonmarker\n## Impact\n\nSeveral quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm) library may lead to unbounded resource exhaustion and subsequent denial of service.\n\nThe following vulnerabilities were addressed:\n\n* [CVE-2023-37463](https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5)\n\nFor more information, consult the release notes for version [`0.29.0.gfm.12`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12).\n\n## Mitigation\n\nUsers are advised to upgrade to commonmarker version [`0.23.10`](https://rubygems.org/gems/commonmarker/versions/0.23.10).", "references": [ { "reference_url": "https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12" }, { "reference_url": "https://github.com/gjtorikian/commonmarker", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker" }, { "reference_url": "https://github.com/gjtorikian/commonmarker/commit/db8cd377b54541f7fd484d168b7682a282a680f7", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker/commit/db8cd377b54541f7fd484d168b7682a282a680f7" }, { "reference_url": "https://rubygems.org/gems/commonmarker/versions/0.23.10", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://rubygems.org/gems/commonmarker/versions/0.23.10" }, { "reference_url": "https://github.com/advisories/GHSA-7vh7-fw88-wj87", "reference_id": "GHSA-7vh7-fw88-wj87", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-7vh7-fw88-wj87" }, { "reference_url": "https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-7vh7-fw88-wj87", "reference_id": "GHSA-7vh7-fw88-wj87", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-7vh7-fw88-wj87" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/66478?format=api", "purl": "pkg:gem/commonmarker@0.23.10", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/commonmarker@0.23.10" } ], "aliases": [ "GHSA-7vh7-fw88-wj87", "GMS-2023-1914" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9q5d-95ws-2uhh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/42559?format=api", "vulnerability_id": "VCID-ph5n-2d4n-mfd3", "summary": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in commonmarker.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22051.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22051.json" }, { "reference_url": "https://github.com/gjtorikian/commonmarker", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker" }, { "reference_url": "https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/CVE-2024-22051.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/CVE-2024-22051.yml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22051", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22051" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2256887", "reference_id": "2256887", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2256887" }, { "reference_url": "https://github.com/advisories/GHSA-fmx4-26r3-wxpf", "reference_id": "GHSA-fmx4-26r3-wxpf", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-fmx4-26r3-wxpf" }, { "reference_url": "https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf", "reference_id": "GHSA-fmx4-26r3-wxpf", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf" }, { "reference_url": "https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x", "reference_id": "GHSA-mc3g-88wq-6f4x", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/60852?format=api", "purl": "pkg:gem/commonmarker@0.23.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-43xy-vnf8-kkbj" }, { "vulnerability": "VCID-9q5d-95ws-2uhh" }, { "vulnerability": "VCID-ryey-1gks-fydw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/commonmarker@0.23.4" } ], "aliases": [ "CVE-2024-22051", "GHSA-fmx4-26r3-wxpf", "GMS-2022-240" ], "risk_score": 4.4, "exploitability": "0.5", "weighted_severity": "8.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ph5n-2d4n-mfd3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/44265?format=api", "vulnerability_id": "VCID-ryey-1gks-fydw", "summary": "Several quadratic complexity bugs may lead to denial of service in Commonmarker\n## Impact\n\nSeveral quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm) library may lead to unbounded resource exhaustion and subsequent denial of service.\n\nThe following vulnerabilities were addressed:\n\n* [CVE-2023-22483](https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c)\n* [CVE-2023-22484](https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r)\n* [CVE-2023-22485](https://github.com/github/cmark-gfm/security/advisories/GHSA-c944-cv5f-hpvr)\n* [CVE-2023-22486](https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p)\n\nFor more information, consult the release notes for version [`0.23.0.gfm.7`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.7).\n\n## Mitigation\n\nUsers are advised to upgrade to commonmarker version [`0.23.7`](https://rubygems.org/gems/commonmarker/versions/0.23.7).", "references": [ { "reference_url": "https://github.com/gjtorikian/commonmarker", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker" }, { "reference_url": "https://github.com/advisories/GHSA-636f-xm5j-pj9m", "reference_id": "GHSA-636f-xm5j-pj9m", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-636f-xm5j-pj9m" }, { "reference_url": "https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-636f-xm5j-pj9m", "reference_id": "GHSA-636f-xm5j-pj9m", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-636f-xm5j-pj9m" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/63689?format=api", "purl": "pkg:gem/commonmarker@0.23.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-9q5d-95ws-2uhh" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/commonmarker@0.23.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/166769?format=api", "purl": "pkg:gem/commonmarker@1.0.0.pre", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/commonmarker@1.0.0.pre" } ], "aliases": [ "GHSA-636f-xm5j-pj9m", "GMS-2023-123" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ryey-1gks-fydw" } ], "fixing_vulnerabilities": [], "risk_score": "4.4", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/commonmarker@0.9.0" }