cmark-gfm: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C
CVE-2022-39209 is fixed in 9 products on 1 platform, first by DEBIAN-CVE-2022-39209, released September 15, 2022. It is not reported as exploited. Patch Radar priority: Routine.
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| cmark-gfm · Debian 12.15 (bookworm) | 0.29.0.gfm.6-2 | DEBIAN-CVE-2022-39209 | Sep 15, 2022 |
| cmark-gfm · Debian 13.5 (trixie) | 0.29.0.gfm.6-2 | DEBIAN-CVE-2022-39209 | Sep 15, 2022 |
| cmark-gfm · Debian 14 | 0.29.0.gfm.6-2 | DEBIAN-CVE-2022-39209 | Sep 15, 2022 |
| cmark-gfm · Ubuntu 20.04 LTS (focal) | 0.29.0.gfm.0-4ubuntu0.1~esm1 | cmark-gfm 0.29.0.gfm.0-4ubuntu0.1~esm1 | Mar 31, 2023 |
| cmark-gfm · Ubuntu 22.04.1 LTS (jammy) | 0.29.0.gfm.3-3ubuntu0.1~esm1 | cmark-gfm 0.29.0.gfm.3-3ubuntu0.1~esm1 | Mar 31, 2023 |
| ghostwriter · Debian 12.15 (bookworm) | 2.1.6+ds-1 | DEBIAN-CVE-2022-39209 | Sep 15, 2022 |
| ghostwriter · Debian 13.5 (trixie) | 2.1.6+ds-1 | DEBIAN-CVE-2022-39209 | Sep 15, 2022 |
| ghostwriter · Debian 14 | 2.1.6+ds-1 | DEBIAN-CVE-2022-39209 | Sep 15, 2022 |
| libcmark-gfm-extensions0 · Ubuntu 20.04 LTS (focal) | 0.29.0.gfm.0-4ubuntu0.1~esm1 | libcmark-gfm-extensions0 0.29.0.gfm.0-4ubuntu0.1~esm1 | Mar 31, 2023 |
| libcmark-gfm-extensions0.29.0.gfm.3 · Ubuntu 22.04.1 LTS (jammy) | 0.29.0.gfm.3-3ubuntu0.1~esm1 | libcmark-gfm-extensions0.29.0.gfm.3 0.29.0.gfm.3-3ubuntu0.1~esm1 | Mar 31, 2023 |
| libcmark-gfm0 · Ubuntu 20.04 LTS (focal) | 0.29.0.gfm.0-4ubuntu0.1~esm1 | libcmark-gfm0 0.29.0.gfm.0-4ubuntu0.1~esm1 | Mar 31, 2023 |
| libcmark-gfm0.29.0.gfm.3 · Ubuntu 22.04.1 LTS (jammy) | 0.29.0.gfm.3-3ubuntu0.1~esm1 | libcmark-gfm0.29.0.gfm.3 0.29.0.gfm.3-3ubuntu0.1~esm1 | Mar 31, 2023 |
| python-cmarkgfm · Debian 13.5 (trixie) | 2024.11.20-1 | DEBIAN-CVE-2022-39209 | Sep 15, 2022 |
| python-cmarkgfm · Debian 14 | 2024.11.20-1 | DEBIAN-CVE-2022-39209 | Sep 15, 2022 |
| r-cran-commonmark · Debian 12.15 (bookworm) | 1.8.1-1 | DEBIAN-CVE-2022-39209 | Sep 15, 2022 |
| r-cran-commonmark · Debian 13.5 (trixie) | 1.8.1-1 | DEBIAN-CVE-2022-39209 | Sep 15, 2022 |
| r-cran-commonmark · Debian 14 | 1.8.1-1 | DEBIAN-CVE-2022-39209 | Sep 15, 2022 |
| ruby-commonmarker · Debian 13.5 (trixie) | 0.23.10-1 | DEBIAN-CVE-2022-39209 | Sep 15, 2022 |
| ruby-commonmarker · Debian 14 | 0.23.10-1 | DEBIAN-CVE-2022-39209 | Sep 15, 2022 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.