The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:1972 advisory.

  - The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse     certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to     process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has     been fixed in version 0.29.0.gfm.1. (CVE-2020-5238)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1972 advisory.

  - cmark-gfm: Exponential time to parse certain inputs could lead to DoS (CVE-2020-5238)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1972 advisory.

    Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that     uses this library.

    Security Fix(es):

    * cmark-gfm: Exponential time to parse certain inputs could lead to DoS (CVE-2020-5238)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2020-5238

  - ghc-cmark-gfm updated to 0.2.2 which rebases the bundled     cmark-gfm to 0.29.0.gfm.1

https://github.com/github/cmark-gfm/security/advisories/GHSA-7gc6-9qr5
-hc85

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2020-5238

  - ghc-cmark-gfm updated to 0.2.2 which rebases the bundled     cmark-gfm to 0.29.0.gfm.1

  - also update hakyll to 4.13.4.0

https://github.com/github/cmark-gfm/security/advisories/GHSA-7gc6-9qr5
-hc85

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
157482	AlmaLinux 8 : pandoc (ALSA-2021:1972)	Nessus	Alma Linux Local Security Checks	medium
149780	CentOS 8 : pandoc (CESA-2021:1972)	Nessus	CentOS Local Security Checks	medium
149707	RHEL 8 : pandoc (RHSA-2021:1972)	Nessus	Red Hat Local Security Checks	medium
141249	Fedora 31 : ghc-cmark-gfm / ghc-hakyll / gitit / pandoc / pandoc-citeproc / etc (2020-fe299b3fa3)	Nessus	Fedora Local Security Checks	medium
141245	Fedora 32 : ghc-cmark-gfm / ghc-hakyll / gitit / pandoc / pandoc-citeproc / etc (2020-1eaffe0013)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2020-5238

medium

Tenable Plugins

medium

medium

medium

medium

medium