Nixpkgs security tracker
6.9 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): Low (L)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): Low (L)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse dismissed (not in Nixpkgs)
commonmark 2.0.0 before 2.8.4 Denial of Service via XML
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.
References
-
GitHub Security Advisory (GHSA-mj63-m3rc-8ppr) vendor-advisory
-
VulnCheck Advisory: commonmark 2.0.0 before 2.8.4 Denial of Service via XML third-party-advisory
Affected products
- ==2.8.4
- <2.8.4
Matching in nixpkgs
pkgs.guile-commonmark
Implementation of CommonMark for Guile
-
nixos-unstable 2020-04-30
- nixpkgs-unstable 2020-04-30
- nixos-unstable-small 0.1.2-unstable-2020-04-30
-
nixos-26.05 2020-04-30
- nixos-26.05-small 2020-04-30
- nixpkgs-26.05-darwin 2020-04-30
pkgs.rubyPackages.commonmarker
None
pkgs.haskellPackages.commonmark
Pure Haskell commonmark parser
pkgs.python313Packages.commonmark
Python CommonMark parser
pkgs.python314Packages.commonmark
Python CommonMark parser
pkgs.rubyPackages_3_3.commonmarker
None
pkgs.rubyPackages_3_4.commonmarker
None
pkgs.rubyPackages_4_0.commonmarker
None
pkgs.haskellPackages.commonmark-cli
Command-line commonmark converter and highlighter
pkgs.python313Packages.recommonmark
Docutils-compatibility bridge to CommonMark
pkgs.python314Packages.recommonmark
Docutils-compatibility bridge to CommonMark
pkgs.rubyPackages.jekyll-commonmark
None
pkgs.haskellPackages.commonmark-pandoc
Bridge between commonmark and pandoc AST
pkgs.haskellPackages.commonmark-simple
Simple interface to commonmark-hs for parsing real-world Markdown
pkgs.haskellPackages.commonmark-initial
An initial encoding of the CommonMark language
pkgs.rubyPackages_3_3.jekyll-commonmark
None
pkgs.rubyPackages_3_4.jekyll-commonmark
None
pkgs.rubyPackages_4_0.jekyll-commonmark
None
pkgs.haskellPackages.commonmark-wikilink
Obsidian-friendly commonmark wikilink parser
pkgs.haskellPackages.commonmark-extensions
Pure Haskell commonmark parser
pkgs.rubyPackages.jekyll-commonmark-ghpages
None