critique
CVE-2024-22051
commonmarker: integer overflow in cmark-gfm's table row parsing may lead to heap memory corruption
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, Ruby Advisory DB. Plus basse selon GHSA (élevée), Red Hat (élevée).
Description
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| rubygems::Ruby Advisory Database | commonmarker | >= 0.23.4 |
| debian 10 | ruby-commonmarker | pas de correctif indiqué |
| debian 11 | ruby-commonmarker | pas de correctif indiqué |
| debian 12 | ruby-commonmarker | 0.23.4-1 |
| debian 13 | ruby-commonmarker | 0.23.4-1 |
| debian 14 | ruby-commonmarker | 0.23.4-1 |
| echo | ruby-commonmarker | 0.23.4-1 |
| rubygems::GitHub Security Advisory RubyGems | commonmarker | 0.23.4 |
Références
- https://access.redhat.com/security/cve/CVE-2024-22051
- https://github.com/advisories/GHSA-fmx4-26r3-wxpf
- https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
- https://github.com/gjtorikian/commonmarker
- https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
- https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/CVE-2024-22051.yml
- https://nvd.nist.gov/vuln/detail/CVE-2024-22051