Out-of-bounds Read in Gomarkdown Markdown
CVE-2023-42821
The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `0.0.0-20230922105210-14b16010c2ee`, which corresponds with commit `14b16010c2ee7ff33a940a541d993bd043a88940`, parsing malformed markdown input with parser that uses parser.Mmark extension could result in out-of-bounds read vulnerability. To exploit the vulnerability, parser needs to have `parser.Mmark` extension set. The panic occurs inside the `citation.go` file on the line 69 when the parser tries to access the element past its length. This can result in a denial of service. Commit `14b16010c2ee7ff33a940a541d993bd043a88940`/pseudoversion `0.0.0-20230922105210-14b16010c2ee` contains a patch for this issue.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.013 (68.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 68th percentile — 68.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.013 · change: +0.002
Affected products
- Gomarkdown Markdown — versions < 0.0.0-20230922105210-14b16010c2ee
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2023-42821?
- CVE-2023-42821 is a high-severity vulnerability in Gomarkdown Markdown, classified under Out-of-bounds Read. CVSS score: 7.5/10. Published 2023-09-22.
- How severe is CVE-2023-42821?
- High severity. CVSS v3 base score is 7.5 out of 10.