markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability.
    If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an     extended period of time. (CVE-2021-26813)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c9b3324f-8e03-4ae3-89ce-8098cdc5bfa9 advisory.

  - markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability.
    If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an     extended period of time. (CVE-2021-26813)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for python-markdown2 fixes the following issues :

Update to 2.4.0 (boo#1181270) :

  - [pull #377] Fixed bug breaking strings elements in     metadata lists

  - [pull #380] When rendering fenced code blocks, also add     the language-LANG class

  - [pull #387] Regex DoS fixes (CVE-2021-26813,     boo#1183171)

  - Switch off failing tests     (gh#trentm/python-markdown2#388), ignore failing test     suite.

update to 2.3.9 :

  - [pull #335] Added header support for wiki tables

  - [pull #336] Reset _toc when convert is run

  - [pull #353] XSS fix

  - [pull #350] XSS fix

  - Add patch to fix unsanitized input for cross-site     scripting (boo#1171379)

ID	Name	Product	Family	Severity
259068	Linux Distros Unpatched Vulnerability : CVE-2021-26813	Nessus	Misc.	high
180382	FreeBSD : py-markdown2 -- regular expression denial of service vulnerability (c9b3324f-8e03-4ae3-89ce-8098cdc5bfa9)	Nessus	FreeBSD Local Security Checks	high
147853	openSUSE Security Update : python-markdown2 (openSUSE-2021-429)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2021-26813

high

Tenable Plugins

high

high

high