Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2022-39209

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.013
EPSS Ranking 78.7%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2022-39209
  • Github » Cmark-Gfm » Version: N/A
    cpe:2.3:a:github:cmark-gfm:-
  • Github » Cmark-Gfm » Version: 0.27.1.gfm.0
    cpe:2.3:a:github:cmark-gfm:0.27.1.gfm.0
  • Github » Cmark-Gfm » Version: 0.27.1.gfm.1
    cpe:2.3:a:github:cmark-gfm:0.27.1.gfm.1
  • Github » Cmark-Gfm » Version: 0.27.1.gfm.2
    cpe:2.3:a:github:cmark-gfm:0.27.1.gfm.2
  • Github » Cmark-Gfm » Version: 0.27.1.gfm.3
    cpe:2.3:a:github:cmark-gfm:0.27.1.gfm.3
  • Github » Cmark-Gfm » Version: 0.27.1.gfm.4
    cpe:2.3:a:github:cmark-gfm:0.27.1.gfm.4
  • Github » Cmark-Gfm » Version: 0.28.0.gfm.10
    cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.10
  • Github » Cmark-Gfm » Version: 0.28.0.gfm.11
    cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.11
  • Github » Cmark-Gfm » Version: 0.28.0.gfm.5
    cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.5
  • Github » Cmark-Gfm » Version: 0.28.0.gfm.6
    cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.6
  • Github » Cmark-Gfm » Version: 0.28.0.gfm.7
    cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.7
  • Github » Cmark-Gfm » Version: 0.28.0.gfm.8
    cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.8
  • Github » Cmark-Gfm » Version: 0.28.0.gfm.9
    cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.9
  • Github » Cmark-Gfm » Version: 0.28.3.gfm.12
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.12
  • Github » Cmark-Gfm » Version: 0.28.3.gfm.13
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.13
  • Github » Cmark-Gfm » Version: 0.28.3.gfm.14
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.14
  • Github » Cmark-Gfm » Version: 0.28.3.gfm.15
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.15
  • Github » Cmark-Gfm » Version: 0.28.3.gfm.16
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.16
  • Github » Cmark-Gfm » Version: 0.28.3.gfm.17
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.17
  • Github » Cmark-Gfm » Version: 0.28.3.gfm.18
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.18
  • Github » Cmark-Gfm » Version: 0.28.3.gfm.19
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.19
  • Github » Cmark-Gfm » Version: 0.28.3.gfm.20
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.20
  • Github » Cmark-Gfm » Version: 0.28.3.gfm.21
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.21
  • Github » Cmark-Gfm » Version: 0.29.0.gfm.0
    cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.0
  • Github » Cmark-Gfm » Version: 0.29.0.gfm.1
    cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.1
  • Github » Cmark-Gfm » Version: 0.29.0.gfm.2
    cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.2
  • Github » Cmark-Gfm » Version: 0.29.0.gfm.3
    cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.3
  • Github » Cmark-Gfm » Version: 0.29.0.gfm.4
    cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.4
  • Github » Cmark-Gfm » Version: 0.29.0.gfm.5
    cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.5
  • Fedoraproject » Fedora » Version: 35
    cpe:2.3:o:fedoraproject:fedora:35
  • Fedoraproject » Fedora » Version: 36
    cpe:2.3:o:fedoraproject:fedora:36
  • Fedoraproject » Fedora » Version: 37
    cpe:2.3:o:fedoraproject:fedora:37


Products
Pricing
Contact Us

Shodan ® - All rights reserved