GHSA-jr9p-r423-9m2r

Source
https://github.com/advisories/GHSA-jr9p-r423-9m2r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-jr9p-r423-9m2r/GHSA-jr9p-r423-9m2r.json
Aliases
Published
2021-06-02T21:44:28Z
Modified
2024-02-21T05:27:22.136219Z
Details

markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.

References

Affected packages

PyPI / markdown2

Package

Name
markdown2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.1.18
Fixed
2.4.0

Affected versions

1.*

1.0.1.18
1.0.1.19
1.1.0
1.1.1
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2

2.*

2.0.0
2.0.1
2.1.0
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.9
2.3.10

Ecosystem specific 

{
    "affected_functions": [
        "markdown2.Markdown.convert"
    ]
}