CVE-2020-5238 Denial of service in table parsing in cmark-gfm

2020-07-0123:05:15

CWE-20

GitHub_M

www.cve.org

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.009 Low

EPSS

Percentile

83.1%

JSON

The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.

CNA Affected

[
  {
    "product": "cmark-gfm",
    "vendor": "github",
    "versions": [
      {
        "status": "affected",
        "version": "< 0.29.0.gfm.1"
      }
    ]
  }
]