crítica
CVE-2024-22051
commonmarker: integer overflow in cmark-gfm's table row parsing may lead to heap memory corruption
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Ruby Advisory DB. Más baja según GHSA (alta), Red Hat (alta).
Descripción
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| rubygems::Ruby Advisory Database | commonmarker | >= 0.23.4 |
| debian 10 | ruby-commonmarker | sin corrección indicada |
| debian 11 | ruby-commonmarker | sin corrección indicada |
| debian 12 | ruby-commonmarker | 0.23.4-1 |
| debian 13 | ruby-commonmarker | 0.23.4-1 |
| debian 14 | ruby-commonmarker | 0.23.4-1 |
| echo | ruby-commonmarker | 0.23.4-1 |
| rubygems::GitHub Security Advisory RubyGems | commonmarker | 0.23.4 |
Referencias
- https://access.redhat.com/security/cve/CVE-2024-22051
- https://github.com/advisories/GHSA-fmx4-26r3-wxpf
- https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
- https://github.com/gjtorikian/commonmarker
- https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
- https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/CVE-2024-22051.yml
- https://nvd.nist.gov/vuln/detail/CVE-2024-22051