Bug 1213317 (CVE-2023-37463) - VUL-0: CVE-2023-37463: cmark,python-cmarkgfm,ghc-cmark-gfm: polynomial time complexity issues
Summary: VUL-0: CVE-2023-37463: cmark,python-cmarkgfm,ghc-cmark-gfm: polynomial time c...
Status: RESOLVED FIXED
Alias: CVE-2023-37463
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/372448/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-37463:5.9:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-07-14 08:36 UTC by Carlos López
Modified: 2024-02-22 14:56 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos López 2023-07-14 08:36:24 UTC
CVE-2023-37463

cmark-gfm is an extended version of the C reference implementation of
CommonMark, a rationalized version of Markdown syntax with a spec. Three
polynomial time complexity issues in cmark-gfm may lead to unbounded resource
exhaustion and subsequent denial of service. These vulnerabilities have been
patched in 0.29.0.gfm.12.


References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-37463
https://www.cve.org/CVERecord?id=CVE-2023-37463
https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12
https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5
Comment 1 Carlos López 2023-07-14 08:37:18 UTC
Afected:
openSUSE:Backports:SLE-15-SP4/ghc-cmark-gfm
openSUSE:Backports:SLE-15-SP5/ghc-cmark-gfm
openSUSE:Backports:SLE-15-SP4/python-cmarkgfm
openSUSE:Backports:SLE-15-SP5/python-cmarkgfm
openSUSE:Factory/python-cmarkgfm
SUSE:ALP:Source:Standard:0.1/python-cmarkgfm

Not affected:
SUSE:SLE-15-SP4:Update/cmark
openSUSE:Factory/cmark

There's 3 relevant fixes [0] [1] [2] in the update [3].

[0] https://github.com/github/cmark-gfm/commit/1d17fa9d5af3215b9c969c66aa2fe22a1030b8a1
[1] https://github.com/github/cmark-gfm/commit/5e8ad61d0a79eb7f7b8ae0863e2ee19387f734f0
[2] https://github.com/github/cmark-gfm/commit/2c5212e0508bbf19e9c7ec9de366b792cbdd6556
[3] https://github.com/github/cmark-gfm/compare/0.29.0.gfm.11...0.29.0.gfm.12
Comment 3 OBSbugzilla Bot 2023-08-14 08:25:04 UTC
This is an autogenerated message for OBS integration:
This bug (1213317) was mentioned in
https://build.opensuse.org/request/show/1103806 Factory / python-cmarkgfm
Comment 5 Dirk Mueller 2023-08-15 08:58:53 UTC
all submitted (thanks Daniel!) also submitted for SLE15.
Comment 8 Carlos López 2024-02-22 14:56:05 UTC
Done, closing.