REDHAT-BUG-2492304: High severity pypi/mistune vulnerability
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parselinktext. When parsing Markdown containing many consecutive [ characters, parselinktext repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mistuneto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs to be able to supply Markdown that the affected Mistune installation parses. Markdown containing many consecutive opening square brackets can trigger excessive CPU consumption with a small input payload.
Which versions should be remediated?
Mistune versions prior to 3.3.0 are affected. Upgrade to version 3.3.0, which fixes the superlinear behavior in parse_link_text.
What is the impact if the issue is exploited?
Parsing the crafted Markdown can take quadratic time, exhausting CPU resources and causing a denial of service.