1. CVE-Search
  2. CVE-2022-39209
ID CVE-2022-39209
Summary cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.
References
Vulnerable Configurations
  • cpe:2.3:a:github:cmark-gfm:-:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:-:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.27.1.gfm.0:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.27.1.gfm.0:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.27.1.gfm.1:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.27.1.gfm.1:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.27.1.gfm.2:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.27.1.gfm.2:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.27.1.gfm.3:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.27.1.gfm.3:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.27.1.gfm.4:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.27.1.gfm.4:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.5:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.5:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.6:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.6:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.7:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.7:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.8:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.8:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.9:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.9:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.10:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.10:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.11:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.0.gfm.11:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.12:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.12:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.13:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.13:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.14:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.14:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.15:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.15:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.16:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.16:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.17:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.17:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.18:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.18:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.19:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.19:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.20:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.20:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.21:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.28.3.gfm.21:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.0:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.0:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.1:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.1:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.2:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.2:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.3:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.3:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.4:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.4:*:*:*:*:*:*:*
  • cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.5:*:*:*:*:*:*:*
    cpe:2.3:a:github:cmark-gfm:0.29.0.gfm.5:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
CVSS
Base: None
Impact:
Exploitability:
CWE CWE-407
CAPEC
Access
VectorComplexityAuthentication
Impact
ConfidentialityIntegrityAvailability
Last major update 11-07-2023 - 20:54
Published 15-09-2022 - 18:15
Last modified 11-07-2023 - 20:54
Back to Top