Integer Overflow or Wraparound Affecting commonmarker package, versions <0.23.4
Threat Intelligence
EPSS
7.52% (95th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-COMMONMARKER-2415031
- published 4 Mar 2022
- disclosed 3 Mar 2022
- credit Felix Wilhelm
Introduced: 3 Mar 2022
CVE-2022-24724 Open this link in a new tabHow to fix?
Upgrade commonmarker to version 0.23.4 or higher.
Overview
Affected versions of this package are vulnerable to Integer Overflow or Wraparound in table-row parsing, when parsing marker rows that contain more than UINT16_MAX columns.
Note If affected versions are used for rendering remote user-controlled markdown, this vulnerability may lead to Remote Code Execution (RCE).
Workaround
The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling any use of the table extension will prevent this vulnerability from being triggered.
References
CVSS Scores
version 3.1