Your message dated Mon, 22 Sep 2025 16:20:09 -0700
with message-id <879294130.0ifERbkFSE@soren-desktop>
and subject line ruby-commonmarker: CVE-2023-26485 CVE-2023-24824
has caused the Debian Bug report #1034174,
regarding ruby-commonmarker: CVE-2023-26485 CVE-2023-24824
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1034174: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034174
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: ruby-commonmarker
X-Debbugs-CC: [email protected]
Severity: important
Tags: security
Hi,
The following vulnerabilities were published for ruby-commonmarker.
CVE-2023-26485[0]:
| cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and
| rendering library and program in C. A polynomial time complexity issue
| in cmark-gfm may lead to unbounded resource exhaustion and subsequent
| denial of service. This CVE covers quadratic complexity issues when
| parsing text which leads with either large numbers of `_` characters.
| This issue has been addressed in version 0.29.0.gfm.10. Users are
| advised to upgrade. Users unable to upgrade should validate that their
| input comes from trusted sources. ### Impact A polynomial time
| complexity issue in cmark-gfm may lead to unbounded resource
| exhaustion and subsequent denial of service. ### Proof of concept ```
| $ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad,
| end="")' | time ./build/src/cmark-gfm --to plaintext ``` Increasing
| the number 10000 in the above commands causes the running time to
| increase quadratically. ### Patches This vulnerability have been
| patched in 0.29.0.gfm.10. ### Note on cmark and cmark-gfm XXX: TBD
| [cmark-gfm](https://github.com/github/cmark-gfm) is a fork of
| [cmark](https://github.com/commonmark/cmark) that adds the GitHub
| Flavored Markdown extensions. The two codebases have diverged over
| time, but share a common core. These bugs affect both `cmark` and
| `cmark-gfm`. ### Credit We would like to thank @gravypod for reporting
| this vulnerability. ### References
| https://en.wikipedia.org/wiki/Time_complexity ### For more information
| If you have any questions or comments about this advisory: * Open an
| issue in [github/cmark-gfm](https://github.com/github/cmark-gfm)
https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5
https://github.com/github/cmark-gfm/commit/07a66c9bc341f902878e37d7da8647d6ef150987
CVE-2023-24824[1]:
| cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and
| rendering library and program in C. A polynomial time complexity issue
| in cmark-gfm may lead to unbounded resource exhaustion and subsequent
| denial of service. This CVE covers quadratic complexity issues when
| parsing text which leads with either large numbers of `>` or `-`
| characters. This issue has been addressed in version 0.29.0.gfm.10.
| Users are advised to upgrade. Users unable to upgrade should validate
| that their input comes from trusted sources.
https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2023-26485
https://www.cve.org/CVERecord?id=CVE-2023-26485
[1] https://security-tracker.debian.org/tracker/CVE-2023-24824
https://www.cve.org/CVERecord?id=CVE-2023-24824
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Closing this as it has been fixed for a while.
--
Soren Stoutner
[email protected]
signature.asc
Description: This is a digitally signed message part.
--- End Message ---
_______________________________________________
Pkg-ruby-extras-maintainers mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-ruby-extras-maintainers
