CVE-2023-22486

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.

cmark incorrectly handled certain inputs. Fixes quadratic complexity in handle_close_bracket "![" which may lead to a denial of service (CVE-2023-22486). Noting that this also fixes a quadratic parsing issue with repeated comment tags that was not in a released product but which was assigned a CVE (CVE-2023-22484).

These are all security issues fixed in the cmark-0.30.3-1.1 package on the GA media of openSUSE Tumbleweed.

cmark-gfm, GitHub's extended version of the CommonMark library in C, suffers from multiple vulnerabilities affecting versions prior to 0.29.0.gfm.12. Various issues, including polynomial time complexity in multiple components like autolink extension, handle_close_bracket, and parsing of certain text patterns (leading >, -, _), may lead to unbounded resource exhaustion and denial of service. An out-of-bounds read in the validate_protocol function was also identified but is considered less harmful. Patches are available in versions 0.29.0.gfm.7, 0.29.0.gfm.10, and 0.29.0.gfm.12. Upgrading is advised, and users unable to upgrade should validate input from trusted sources.

This update for cmark fixes the following issues:

• CVE-2023-22486: Fixed quadratic complexity in handle_close_bracket may lead to a denial of service (bsc#1207674).

It was discovered that cmark-gfm's autolink extension did not correctly handle parsing large inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-39209)

It was discovered that cmark-gfm did not correctly handle parsing large inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2023-22483)

It was discovered that cmark-gfm did not correctly handle parsing large inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2023-22484)

It was discovered that cmark-gfm did not correctly handle parsing large inputs. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-22486, CVE-2023-26485)