CVE-2018-18385 Asciidoctor Infinite Loop vulnerability
Remote attackers can cause a denial of service via an infinite loop in the Asciidoctor parser due to regex mismatch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-18385?
CVE-2018-18385 is a high-severity denial of service vulnerability in n/a, published on 16 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.
Weakness: CWE-835
Which versions are affected by CVE-2018-18385?
2 open source packages ship an affected version, including asciidoctor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
asciidoctor RubyGems | All versions | 1.5.8 |
asciidoctor RubyGems | All versions | 1.5.8 |
Products include Asciidoctor Asciidoctor.
How do I fix CVE-2018-18385?
Upgrade asciidoctor to 1.5.8 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-18385 being exploited?
There is no known exploitation of CVE-2018-18385 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2018-18385, GHSA-qc9p-mjxm-j2wj, UBUNTU-CVE-2018-18385.