CVE-2022-21680: Cubic catastrophic backtracking (ReDoS) in marked
First published: Fri Jan 14 2022(Updated: )
### Impact _What kind of vulnerability is it?_ Denial of service. The regular expression `block.def` may cause catastrophic backtracking against some strings. PoC is the following. ```javascript import * as marked from "marked"; marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`); ``` _Who is impacted?_ Anyone who runs untrusted markdown through marked and does not use a worker with a time limit. ### Patches _Has the problem been patched?_ Yes _What versions should users upgrade to?_ 4.0.10 ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ Do not run untrusted markdown through marked or run marked on a [worker](https://marked.js.org/using_advanced#workers) thread and set a reasonable time limit to prevent draining resources. ### References _Are there any links users can visit to find out more?_ - https://marked.js.org/using_advanced#workers - https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS ### For more information If you have any questions or comments about this advisory: * Open an issue in [marked](https://github.com/markedjs/marked)
Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/marked | <4.0.10 | 4.0.10 |
| redhat/markedjs | <4.0.10 | 4.0.10 |
| Marked Project | <4.0.10 | |
| Red Hat Fedora | =36 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/markedjs/marked/security/advisories/GHSA-rrrm-qjm4-v8hf
- https://nvd.nist.gov/vuln/detail/CVE-2022-21680
- https://github.com/markedjs/marked/commit/c4a3ccd344b6929afa8a1d50ac54a721e57012c0
- https://github.com/markedjs/marked/releases/tag/v4.0.10
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX/
- https://github.com/advisories/GHSA-rrrm-qjm4-v8hf (Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2090335
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2090573
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2090570
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2090574
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2090575
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2090576
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2090577
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2090578
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2090569
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2090571
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2090579
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2090580
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2090572
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2090581
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2090582
- https://github.com/argoproj/argo-cd/releases/tag/v2.3.0
- https://github.com/argoproj/argo-cd/pull/8573/files#diff-3a968206d6de2fecfc5dacd7d94bab7744c9f5d5c999a816164d95cbc135c316R5918
- https://access.redhat.com/errata/RHSA-2023:3642
- https://bugzilla.redhat.com/show_bug.cgi?id=2082705
Frequently Asked Questions
What is the severity of CVE-2022-21680?
The severity of CVE-2022-21680 is classified as a denial of service vulnerability.
How can CVE-2022-21680 be exploited?
CVE-2022-21680 can be exploited through specially crafted input that causes catastrophic backtracking in the regular expression `block.def`.
How do I fix CVE-2022-21680?
To fix CVE-2022-21680, upgrade to marked version 4.0.10 or later.
What software is affected by CVE-2022-21680?
CVE-2022-21680 affects the marked package versions prior to 4.0.10.
Is CVE-2022-21680 relevant to specific operating systems?
Yes, CVE-2022-21680 is relevant to systems using marked, including those running Fedora 36.
- collector/github-advisory-latest
- alias/GHSA-rrrm-qjm4-v8hf
- alias/CVE-2022-21680
- collector/github-advisory
- agent/weakness
- agent/type
- agent/author
- agent/references
- agent/severity
- agent/remedy
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-cve
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- package-manager/npm
- package-manager/redhat
- vendor/marked project
- canonical/marked project
- vendor/fedoraproject
- canonical/red hat fedora
- version/red hat fedora/36