Log in Start free

Vulnerability · Published Oct 15, 2024 · Assigned by mitre

CVE-2024-44337

Medium 5.1

In plain English

A medium-severity security flaw in the golang-github-gomarkdown-markdown package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.1Medium
Exploit odds (30 days)0.5%top 56.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `v0.0.0-20240729232818-a2a9c4f`, which corresponds with commit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252`, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252` contains fixes to this problem.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-github-gomarkdown-markdownno fix listedDEBIAN-CVE-2024-44337
Debian:13golang-github-gomarkdown-markdownno fix listedDEBIAN-CVE-2024-44337
Debian:14golang-github-gomarkdown-markdown0.0~git20260725.8435af3-1DEBIAN-CVE-2024-44337
Gogithub.com/gomarkdown/markdown0.0.0-20240729212818-a2a9c4f76ef5GHSA-xhr3-wf7j-h255
Gogithub.com/gomarkdown/markdown0.0.0-20240729212818-a2a9c4f76ef5GO-2024-3205
Ubuntu:24.04:LTSgolang-github-gomarkdown-markdownno fix listedUBUNTU-CVE-2024-44337
Ubuntu:25.10golang-github-gomarkdown-markdownno fix listedUBUNTU-CVE-2024-44337
Ubuntu:26.04:LTSgolang-github-gomarkdown-markdownno fix listedUBUNTU-CVE-2024-44337
Ubuntu:26.10golang-github-gomarkdown-markdownno fix listedUBUNTU-CVE-2024-44337

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References