Nixpkgs security tracker
8.7 HIGH
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse dismissed (not in Nixpkgs)
commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.
References
-
GitHub Security Advisory (GHSA-jfm3-95jq-q3rf) vendor-advisory
-
VulnCheck Advisory: commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote third-party-advisory
Affected products
- ==2.8.4
- <2.8.4
Matching in nixpkgs
pkgs.guile-commonmark
Implementation of CommonMark for Guile
-
nixos-unstable 2020-04-30
- nixpkgs-unstable 2020-04-30
- nixos-unstable-small 0.1.2-unstable-2020-04-30
-
nixos-26.05 2020-04-30
- nixos-26.05-small 2020-04-30
- nixpkgs-26.05-darwin 2020-04-30
pkgs.rubyPackages.commonmarker
None
pkgs.haskellPackages.commonmark
Pure Haskell commonmark parser
pkgs.python313Packages.commonmark
Python CommonMark parser
pkgs.python314Packages.commonmark
Python CommonMark parser
pkgs.rubyPackages_3_3.commonmarker
None
pkgs.rubyPackages_3_4.commonmarker
None
pkgs.rubyPackages_4_0.commonmarker
None
pkgs.haskellPackages.commonmark-cli
Command-line commonmark converter and highlighter
pkgs.python313Packages.recommonmark
Docutils-compatibility bridge to CommonMark
pkgs.python314Packages.recommonmark
Docutils-compatibility bridge to CommonMark
pkgs.rubyPackages.jekyll-commonmark
None
pkgs.haskellPackages.commonmark-pandoc
Bridge between commonmark and pandoc AST
pkgs.haskellPackages.commonmark-simple
Simple interface to commonmark-hs for parsing real-world Markdown
pkgs.haskellPackages.commonmark-initial
An initial encoding of the CommonMark language
pkgs.rubyPackages_3_3.jekyll-commonmark
None
pkgs.rubyPackages_3_4.jekyll-commonmark
None
pkgs.rubyPackages_4_0.jekyll-commonmark
None
pkgs.haskellPackages.commonmark-wikilink
Obsidian-friendly commonmark wikilink parser
pkgs.haskellPackages.commonmark-extensions
Pure Haskell commonmark parser
pkgs.rubyPackages.jekyll-commonmark-ghpages
None