CVE-2023-22483 - Vulnerability Details - OpenCVE

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynomial time complexity issues in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically. These vulnerabilities have been patched in version 0.29.0.gfm.7.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Github	Cmark-gfm

Configuration 1 [-]

cpe:2.3:a:github:cmark-gfm:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c

History

Mon, 10 Mar 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-01-23T22:36:14.574Z

Updated: 2025-03-10T21:21:03.509Z

Reserved: 2022-12-29T17:41:28.088Z

Link: CVE-2023-22483

Vulnrichment

Updated: 2024-08-02T10:13:48.482Z

NVD

Status : Modified

Published: 2023-01-23T23:15:10.307

Modified: 2024-11-21T07:44:53.860

Link: CVE-2023-22483

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-22483", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2022-12-29T17:41:28.088Z", "datePublished": "2023-01-23T22:36:14.574Z", "dateUpdated": "2025-03-10T21:21:03.509Z"}, "containers": {"cna": {"title": "cmark-gfm Quadratic complexity bugs may lead to a denial of service", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c"}], "affected": [{"vendor": "github", "product": "cmark-gfm", "versions": [{"version": "< 0.29.0.gfm.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-01-23T22:36:14.574Z"}, "descriptions": [{"lang": "en", "value": "cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynomial time complexity issues in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically. These vulnerabilities have been patched in version 0.29.0.gfm.7.\n"}], "source": {"advisory": "GHSA-29g3-96g3-jg6c", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:13:48.482Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-10T21:01:33.176698Z", "id": "CVE-2023-22483", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T21:21:03.509Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c", "name": "https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:13:48.482Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-22483", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-10T21:01:33.176698Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T21:01:34.700Z"}}], "cna": {"title": "cmark-gfm Quadratic complexity bugs may lead to a denial of service", "source": {"advisory": "GHSA-29g3-96g3-jg6c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "github", "product": "cmark-gfm", "versions": [{"status": "affected", "version": "< 0.29.0.gfm.7"}]}], "references": [{"url": "https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c", "name": "https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynomial time complexity issues in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically. These vulnerabilities have been patched in version 0.29.0.gfm.7.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-01-23T22:36:14.574Z"}}}, "cveMetadata": {"cveId": "CVE-2023-22483", "state": "PUBLISHED", "dateUpdated": "2025-03-10T21:21:03.509Z", "dateReserved": "2022-12-29T17:41:28.088Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-01-23T22:36:14.574Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:github:cmark-gfm:*:*:*:*:*:*:*:*", "matchCriteriaId": "BEFD0856-0CFF-4D0F-B9D5-02F4A537C5CE", "versionEndExcluding": "0.29.0.gfm.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynomial time complexity issues in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically. These vulnerabilities have been patched in version 0.29.0.gfm.7.\n"}, {"lang": "es", "value": "cmark-gfm es la bifurcaci\u00f3n de GitHub de cmark, una librer\u00eda y programa de an\u00e1lisis y representaci\u00f3n de CommonMark en C. Las versiones anteriores a 0.29.0.gfm.7 est\u00e1n sujetas a varios problemas de complejidad de tiempo polinomial en cmark-gfm que pueden provocar un agotamiento ilimitado de los recursos y posterior denegaci\u00f3n del servicio. Varios comandos, cuando se canalizan a cmak-gfm con valores grandes, hacen que el tiempo de ejecuci\u00f3n aumente cuadr\u00e1ticamente. Estas vulnerabilidades se han solucionado en la versi\u00f3n 0.29.0.gfm.7."}], "id": "CVE-2023-22483", "lastModified": "2024-11-21T07:44:53.860", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-01-23T23:15:10.307", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-407"}], "source": "nvd@nist.gov", "type": "Primary"}]}