Homepage

Overly Restrictive Regular Expression The advisory has been revoked - it doesn't affect any version of package cockpit-system  (opens in a new tab)

Threat Intelligence

EPSS
0.36% (73rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS8-COCKPITSYSTEM-2810245
  • published7 May 2022
  • disclosed14 Jan 2022
Report a new vulnerability Found a mistake?

Introduced: 14 Jan 2022

CVE-2022-21680  (opens in a new tab)
CWE-186  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream cockpit-system package and not the cockpit-system package as distributed by Centos.

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression block.def may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.