cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions     prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to     unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in     0.29.0.gfm.7. (CVE-2023-22486)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7319-1 advisory.

    It was discovered that cmark-gfm's autolink extension did not correctly handle parsing large inputs. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04     LTS and Ubuntu 22.04 LTS. (CVE-2022-39209)

    It was discovered that cmark-gfm did not correctly handle parsing large inputs. An attacker could possibly     use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS     and Ubuntu 24.10. (CVE-2023-22483)

    It was discovered that cmark-gfm did not correctly handle parsing large inputs. An attacker could possibly     use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10.
    (CVE-2023-22484)

    It was discovered that cmark-gfm did not correctly handle parsing large inputs. An attacker could possibly     use this issue to cause a denial of service. (CVE-2023-22486, CVE-2023-26485)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions
    prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to
    unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in
    0.29.0.gfm.7. (CVE-2023-22486)

ID	Name	Product	Family	Type	Severity
225924	Linux Distros Unpatched Vulnerability : CVE-2023-22486	Nessus	Misc.	Local	high
218384	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : cmark-gfm vulnerabilities (USN-7319-1)	Nessus	Ubuntu Local Security Checks	Local	high
403862	Alpine: libcmark, multiple cmark packages: security update to 0.30.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
403862	Alpine: libcmark, multiple cmark packages: security update to 0.30.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2023-22486

high

Tenable Plugins

high

high

high

high