cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-d1e9e62a92 advisory.

  - cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In     versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may     lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by     running `python3 -c 'print(![l* 100000 + \n)' | ./cmark-gfm -e autolink`, which will resource exhaust     on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in     0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink     extension. (CVE-2022-39209)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-f1aed93db8 advisory.

  - cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In     versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may     lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by     running `python3 -c 'print(![l* 100000 + \n)' | ./cmark-gfm -e autolink`, which will resource exhaust     on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in     0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink     extension. (CVE-2022-39209)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-6bcee2cc93 advisory.

  - cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In     versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may     lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by     running `python3 -c 'print(![l* 100000 + \n)' | ./cmark-gfm -e autolink`, which will resource exhaust     on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in     0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink     extension. (CVE-2022-39209)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
185204	Fedora 39 : ghostwriter (2023-d1e9e62a92)	Nessus	Fedora Local Security Checks	medium
169126	Fedora 35 : ghc-cmark-gfm (2022-f1aed93db8)	Nessus	Fedora Local Security Checks	medium
169093	Fedora 36 : ghc-cmark-gfm (2022-6bcee2cc93)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2022-39209

medium

Tenable Plugins

medium

medium

medium