markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability.
    If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an     extended period of time. (CVE-2021-26813)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability.
    If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an
    extended period of time. (CVE-2021-26813)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c9b3324f-8e03-4ae3-89ce-8098cdc5bfa9 advisory.

  - markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability.
    If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an     extended period of time. (CVE-2021-26813)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for python-markdown2 fixes the following issues :

Update to 2.4.0 (boo#1181270) :

  - [pull #377] Fixed bug breaking strings elements in     metadata lists

  - [pull #380] When rendering fenced code blocks, also add     the language-LANG class

  - [pull #387] Regex DoS fixes (CVE-2021-26813,     boo#1183171)

  - Switch off failing tests     (gh#trentm/python-markdown2#388), ignore failing test     suite.

update to 2.3.9 :

  - [pull #335] Added header support for wiki tables

  - [pull #336] Reset _toc when convert is run

  - [pull #353] XSS fix

  - [pull #350] XSS fix

  - Add patch to fix unsanitized input for cross-site     scripting (boo#1171379)

ID	Name	Product	Family	Severity
259068	Linux Distros Unpatched Vulnerability : CVE-2021-26813	Nessus	Misc.	high
416556	SCA: security update for markdown2 (GHSA-jr9p-r423-9m2r)	Tenable Cloud Security	SCA Checks	high
416556	SCA: security update for markdown2 (GHSA-jr9p-r423-9m2r)	Tenable Self-Hosted Container Security	SCA Checks	high
180382	FreeBSD : py-markdown2 -- regular expression denial of service vulnerability (c9b3324f-8e03-4ae3-89ce-8098cdc5bfa9)	Nessus	FreeBSD Local Security Checks	high
147853	openSUSE Security Update : python-markdown2 (openSUSE-2021-429)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2021-26813

high

Tenable Plugins

high

high

high

high

high