Homepage

Overly Restrictive Regular Expression The advisory has been revoked - it doesn't affect any version of package cockpit  (opens in a new tab)

Threat Intelligence

EPSS
0.2% (59th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS8-COCKPIT-2810073
  • published7 May 2022
  • disclosed14 Jan 2022
Report a new vulnerability Found a mistake?

Introduced: 14 Jan 2022

CVE-2022-21681  (opens in a new tab)
CWE-186  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream cockpit package and not the cockpit package as distributed by Centos.

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.