cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing `table.c:row_from_string` may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where `cmark-gfm` is used. If `cmark-gfm` is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the `cmark-gfm` library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions     0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing     `table.c:row_from_string` may lead to heap memory corruption when parsing tables who's marker rows contain     more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary     Code Execution depending on how and where `cmark-gfm` is used. If `cmark-gfm` is used for rendering remote     user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications     employing affected versions of the `cmark-gfm` library. This vulnerability has been patched in the     following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability     exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this     vulnerability from being triggered. (CVE-2022-24724)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:5597 advisory.

  - cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions     0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing     `table.c:row_from_string` may lead to heap memory corruption when parsing tables who's marker rows contain     more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary     Code Execution depending on how and where `cmark-gfm` is used. If `cmark-gfm` is used for rendering remote     user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications     employing affected versions of the `cmark-gfm` library. This vulnerability has been patched in the     following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability     exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this     vulnerability from being triggered. (CVE-2022-24724)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5597 advisory.

    Pandoc is a markdown/markup conversion tool. The version of pandoc in RHEL 8 CRB uses cmark-gfm (GitHub's     extended version of the C reference implementation of CommonMark) for parts of its conversion. The update,     fixes CVE-2022-24724: an integer overflow in cmark-gfm's table row parsing which may lead to heap memory     corruption when parsing tables with more than UINT16_MAX columns.

    Security Fix(es):

    * cmark-gfm: possible RCE due to integer overflow (CVE-2022-24724)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
224595	Linux Distros Unpatched Vulnerability : CVE-2022-24724	Nessus	Misc.	critical
163342	AlmaLinux 8 : pandoc (5597) (ALSA-2022:5597)	Nessus	Alma Linux Local Security Checks	critical
163269	RHEL 8 : pandoc (RHSA-2022:5597)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2022-24724

critical

Tenable Plugins

critical

critical

critical