kritik
CVE-2024-22051
commonmarker: integer overflow in cmark-gfm's table row parsing may lead to heap memory corruption
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Ruby Advisory DB. Daha düşük diyenler: GHSA (yüksek), Red Hat (yüksek).
Açıklama
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| rubygems::Ruby Advisory Database | commonmarker | >= 0.23.4 |
| debian 10 | ruby-commonmarker | düzeltme belirtilmemiş |
| debian 11 | ruby-commonmarker | düzeltme belirtilmemiş |
| debian 12 | ruby-commonmarker | 0.23.4-1 |
| debian 13 | ruby-commonmarker | 0.23.4-1 |
| debian 14 | ruby-commonmarker | 0.23.4-1 |
| echo | ruby-commonmarker | 0.23.4-1 |
| rubygems::GitHub Security Advisory RubyGems | commonmarker | 0.23.4 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2024-22051
- https://github.com/advisories/GHSA-fmx4-26r3-wxpf
- https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
- https://github.com/gjtorikian/commonmarker
- https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
- https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/CVE-2024-22051.yml
- https://nvd.nist.gov/vuln/detail/CVE-2024-22051