comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A Comrak AST can be constructed manually by a program instead of parsing a Markdown document with `parse_document`. This AST can then be converted to HTML via `html::format_document_with_plugins`. However, the HTML formatting code assumes that the AST is well-formed. For example, many AST notes contain `[u8]` fields which the formatting code assumes is valid UTF-8 data. Several bugs can be triggered if this is not the case. Version 0.17.0 contains adjustments to the AST, storing strings instead of unvalidated byte arrays. Users are advised to upgrade. Users unable to upgrade may manually validate UTF-8 correctness of all data when assigning to `&[u8]` and `Vec<u8>` fields in the AST. This issue is also tracked as `GHSL-2023-049`.

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-aa46db07fd advisory.

    - Update comrak to version 0.18.0.
    - Disable the unused markdown support in askama and askama_shared crates, which depends on an ancient     version of comrak.

    This update also includes fixes for two medium-severity security issues in comrak (CVE-2023-28631 and     CVE-2023-28626).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-e9243281cb advisory.

    - Update comrak to version 0.18.0.
    - Disable the unused markdown support in askama and askama_shared crates, which depends on an ancient     version of comrak.

    This update also includes fixes for two medium-severity security issues in comrak (CVE-2023-28631 and     CVE-2023-28626).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-035d5910b9 advisory.

    - Update comrak to version 0.18.0.
    - Disable the unused markdown support in askama and askama_shared crates, which depends on an ancient     version of comrak.

    This update also includes fixes for two medium-severity security issues in comrak (CVE-2023-28631 and     CVE-2023-28626).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-b37722768e advisory.

    - Update comrak to version 0.18.0.
    - Disable the unused markdown support in askama and askama_shared crates, which depends on an ancient     version of comrak.

    This update also includes fixes for two medium-severity security issues in comrak (CVE-2023-28631 and     CVE-2023-28626).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
185224	Fedora 39 : rust-askama / rust-askama_shared / rust-comrak (2023-aa46db07fd)	Nessus	Fedora Local Security Checks	critical
174939	Fedora 37 : rust-askama / rust-askama_shared / rust-comrak (2023-e9243281cb)	Nessus	Fedora Local Security Checks	critical
174937	Fedora 38 : rust-askama / rust-askama_shared / rust-comrak (2023-035d5910b9)	Nessus	Fedora Local Security Checks	critical
174935	Fedora 36 : rust-askama / rust-askama_shared / rust-comrak (2023-b37722768e)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2023-28631

critical

Tenable Plugins

critical

critical

critical

critical