The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:3259-1 advisory.

  - The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default,     which allows unintended read access (such as template=/etc/passwd) or unintended embedded Ruby code     execution (such as a string that begins with template=string://<%= `). NOTE: kramdown is used in Jekyll,     GitLab Pages, GitHub Pages, and Thredded Forum. (CVE-2020-14001)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.10 host has packages installed that are affected by a vulnerability as referenced in the USN-4562-2 advisory.

  - The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default,     which allows unintended read access (such as template=/etc/passwd) or unintended embedded Ruby code     execution (such as a string that begins with template=string://<%= `). NOTE: kramdown is used in Jekyll,     GitLab Pages, GitHub Pages, and Thredded Forum. (CVE-2020-14001)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4562-1 advisory.

  - The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default,     which allows unintended read access (such as template=/etc/passwd) or unintended embedded Ruby code     execution (such as a string that begins with template=string://<%= `). NOTE: kramdown is used in Jekyll,     GitLab Pages, GitHub Pages, and Thredded Forum. (CVE-2020-14001)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A security flaw was found on ruby kramdown which may lead to unintended code execution. This vulnerability is now assigned as CVE-2020-14001 . This new rpm should fix this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A security flaw was found on ruby kramdown which may lead to unintended code execution. THis vulnerability is now assigned as CVE-2020-14001 . This new rpm should fix this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was discovered in ruby-kramdown, a fast, pure ruby, Markdown parser and converter, which could result in unintended read access to files or unintended embedded Ruby code execution when the {::options /} extension is used together with the 'template' option.

The update introduces a new option 'forbidden_inline_options' to restrict the options allowed with the {::options /} extension. By default the 'template' option is forbidden.

ruby-kramdown processes the template option inside Kramdown documents by default, which allows unintended read access (such as template='/etc/passwd') or unintended embedded Ruby code execution (such as a string that begins with template='string://<%= `). NOTE:
kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

For Debian 9 stretch, this problem has been fixed in version 1.12.0-1+deb9u1.

We recommend that you upgrade your ruby-kramdown packages.

For the detailed security status of ruby-kramdown please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/ruby-kramdown

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gitlab reports :

Arbitrary File Read when Moving an Issue

Memory Exhaustion via Excessive Logging of Invite Email Error

Denial of Service Through Project Import Feature

User Controlled Git Configuration Settings Resulting in SSRF

Stored XSS in Issue Reference Number Tooltip

Stored XSS in Issues List via Milestone Title

Improper Access Control After Group Transfer

Bypass Email Verification Required for OAuth Flow

Confusion When Using Hexadecimal Branch Names

Insufficient OAuth Revocation

Improper Access Control for Project Sharing

Stored XSS in Jobs Page

Improper Access Control of Applications Page

SSRF into Shared Runner

Update Kramdown Gem

kramdown news :

CVE-2020-14001 is addressed to avoid problems when using the {::options /} extension together with the 'template' option.

ID	Name	Product	Family	Severity
164981	SUSE SLES15 Security Update : rubygem-kramdown (SUSE-SU-2022:3259-1)	Nessus	SuSE Local Security Checks	critical
141922	Ubuntu 20.10 : kramdown vulnerability (USN-4562-2)	Nessus	Ubuntu Local Security Checks	critical
141095	Ubuntu 20.04 LTS : kramdown vulnerability (USN-4562-1)	Nessus	Ubuntu Local Security Checks	critical
139713	Fedora 32 : rubygem-kramdown (2020-f6eee9a2d3)	Nessus	Fedora Local Security Checks	critical
139708	Fedora 31 : rubygem-kramdown (2020-5c70d97eca)	Nessus	Fedora Local Security Checks	critical
139521	Debian DSA-4743-1 : ruby-kramdown - security update	Nessus	Debian Local Security Checks	critical
139427	Debian DLA-2316-1 : ruby-kramdown security update	Nessus	Debian Local Security Checks	critical
139394	FreeBSD : Gitlab -- Multiple Vulnerabilities (a003b74f-d7b3-11ea-9df1-001b217b3468)	Nessus	FreeBSD Local Security Checks	critical
138245	FreeBSD : kramdown -- template option vulnerability (20b46222-c12b-11ea-abe8-08002728f74c)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2020-14001

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical