CVE-2021-26813: High severity markdown2 vulnerability
Published Mar 3, 2021
·Updated
markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.
Affected Software
5 affected componentsFixes available
pip/markdown2>=1.0.1.18<2.4.0
2.4.0
Markdown2 Project Markdown2>=1.0.1.18<2.4.0
Fedoraproject Fedora=32
Fedoraproject Fedora=33
Fedoraproject Fedora=34
Event History
Mar 3, 2021
CVE Published
via MITRE·03:17 PM
Data Sourced
via MITRE·03:17 PM
Description
Jun 2, 2021
Advisory Published
09:44 PM
Frequently Asked Questions
1
What is CVE-2021-26813?
CVE-2021-26813 is a vulnerability in markdown2 version 1.0.1.18 that allows for a regular expression denial of service attack.
2
How does CVE-2021-26813 affect markdown2?
CVE-2021-26813 affects markdown2 version 1.0.1.18 by allowing an attacker to provide a malicious string that can cause processing delays or difficulties.
3
What is the severity of CVE-2021-26813?
CVE-2021-26813 has a severity rating of 7.5 (high).
4
Which software versions are affected by CVE-2021-26813?
Markdown2 version 1.0.1.18, as well as Fedora versions 32, 33, and 34, are affected by CVE-2021-26813.
5
How do I fix CVE-2021-26813?
To fix CVE-2021-26813, update markdown2 to version 2.4.0 or later.