GHSA-xxmq-4vph-956w
Suggest an improvement- Source
- https://github.com/advisories/GHSA-xxmq-4vph-956w
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-xxmq-4vph-956w/GHSA-xxmq-4vph-956w.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-xxmq-4vph-956w
- Published
- 2023-03-28T14:44:04Z
- Modified
- 2023-03-28T14:44:04Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- Comrak vulnerable to production of excessive output when parsing Markdown (GHSL-2023-048)
- Details
-
Impact
comrak is vulnerable to the upstream cmark issue, "Issue revealed by fuzzer". A large number of references in a markdown document can trigger an overly large response.
Patches
0.17.0 contains https://github.com/kivikakk/comrak/commit/70f97f3ea4eae30ffbd1b94c764a3de2f1c41d2a, which limits reference output to a 100Kb maximum.
Workarounds
n/a
References
- https://github.com/commonmark/cmark/issues/354
- References
Affected packages
crates.io / comrak
Package
- Name
- comrak
- View open source insights on deps.dev
- Purl
- pkg:cargo/comrak