Lookup for vulnerable packages by Package URL.
| Purl | pkg:gem/commonmarker@0.14.1 |
|---|
| Type | gem |
|---|
| Namespace | |
|---|
| Name | commonmarker |
|---|
| Version | 0.14.1 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | true |
|---|
| Next_non_vulnerable_version | 0.23.10 |
|---|
| Latest_non_vulnerable_version | 1.0.0.pre |
|---|
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-43xy-vnf8-kkbj |
| vulnerability_id |
VCID-43xy-vnf8-kkbj |
| summary |
Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service
### Impact
CommonMarker uses `cmark-gfm` for rendering [Github Flavored
Markdown](https://github.github.com/gfm/). A polynomial time complexity issue
in cmark-gfm's autolink extension may lead to unbounded resource exhaustion
and subsequent denial of service.
### Patches
This vulnerability has been patched in the following CommonMarker release:
- v0.23.6
### Workarounds
Disable use of the autolink extension.
### References
https://en.wikipedia.org/wiki/Time_complexity |
| references |
|
| fixed_packages |
|
| aliases |
GHSA-4qw4-jpp4-8gvp
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-43xy-vnf8-kkbj |
|
| 1 |
| url |
VCID-9q5d-95ws-2uhh |
| vulnerability_id |
VCID-9q5d-95ws-2uhh |
| summary |
Several quadratic complexity bugs may lead to denial of service in Commonmarker
## Impact
Several quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm) library may lead to unbounded resource exhaustion and subsequent denial of service.
The following vulnerabilities were addressed:
* [CVE-2023-37463](https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5)
For more information, consult the release notes for version [`0.29.0.gfm.12`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12).
## Mitigation
Users are advised to upgrade to commonmarker version [`0.23.10`](https://rubygems.org/gems/commonmarker/versions/0.23.10). |
| references |
|
| fixed_packages |
|
| aliases |
GHSA-7vh7-fw88-wj87, GMS-2023-1914
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9q5d-95ws-2uhh |
|
| 2 |
|
| 3 |
| url |
VCID-ryey-1gks-fydw |
| vulnerability_id |
VCID-ryey-1gks-fydw |
| summary |
Several quadratic complexity bugs may lead to denial of service in Commonmarker
## Impact
Several quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm) library may lead to unbounded resource exhaustion and subsequent denial of service.
The following vulnerabilities were addressed:
* [CVE-2023-22483](https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c)
* [CVE-2023-22484](https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r)
* [CVE-2023-22485](https://github.com/github/cmark-gfm/security/advisories/GHSA-c944-cv5f-hpvr)
* [CVE-2023-22486](https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p)
For more information, consult the release notes for version [`0.23.0.gfm.7`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.7).
## Mitigation
Users are advised to upgrade to commonmarker version [`0.23.7`](https://rubygems.org/gems/commonmarker/versions/0.23.7). |
| references |
|
| fixed_packages |
|
| aliases |
GHSA-636f-xm5j-pj9m, GMS-2023-123
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ryey-1gks-fydw |
|
|
|---|
| Fixing_vulnerabilities |
|
|---|
| Risk_score | 4.4 |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:gem/commonmarker@0.14.1 |
|---|