Nixpkgs security tracker
7.5 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.
References
-
https://github.com/thephpleague/commonmark/releases/tag/2.9.0 x_refsource_MISC
Affected products
- ==>= 0.6.0, < 2.9.0
Matching in nixpkgs
pkgs.guile-commonmark
Implementation of CommonMark for Guile
-
nixos-unstable -
- nixos-unstable-small 0.1.2-unstable-2020-04-30
-
nixos-26.05 -
- nixos-26.05-small 2020-04-30
pkgs.rubyPackages.commonmarker
None
pkgs.haskellPackages.commonmark
Pure Haskell commonmark parser
pkgs.python313Packages.commonmark
Python CommonMark parser
pkgs.python314Packages.commonmark
Python CommonMark parser
pkgs.rubyPackages_3_3.commonmarker
None
pkgs.rubyPackages_3_4.commonmarker
None
pkgs.rubyPackages_4_0.commonmarker
None
pkgs.haskellPackages.commonmark-cli
Command-line commonmark converter and highlighter
pkgs.python313Packages.recommonmark
Docutils-compatibility bridge to CommonMark
pkgs.python314Packages.recommonmark
Docutils-compatibility bridge to CommonMark
pkgs.rubyPackages.jekyll-commonmark
None
pkgs.haskellPackages.commonmark-pandoc
Bridge between commonmark and pandoc AST
pkgs.haskellPackages.commonmark-simple
Simple interface to commonmark-hs for parsing real-world Markdown
pkgs.haskellPackages.commonmark-initial
An initial encoding of the CommonMark language
pkgs.rubyPackages_3_3.jekyll-commonmark
None
pkgs.rubyPackages_3_4.jekyll-commonmark
None
pkgs.rubyPackages_4_0.jekyll-commonmark
None
pkgs.haskellPackages.commonmark-wikilink
Obsidian-friendly commonmark wikilink parser
pkgs.haskellPackages.commonmark-extensions
Pure Haskell commonmark parser
pkgs.rubyPackages.jekyll-commonmark-ghpages
None