CVE-2024-22051 CommonMarker Integer Overflow Vulnerability
Remote attackers can trigger heap memory corruption and potential code execution by parsing malicious Markdown tables with excessive columns.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-22051?
CVE-2024-22051 is a critical vulnerability in github:cmark-gfm, published on 4 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.
Weakness: CWE-190
Which versions are affected by CVE-2024-22051?
2 open source packages ship an affected version, including commonmarker. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
commonmarker RubyGems | All versions | 0.23.4 |
commonmarker RubyGems | All versions | 0.23.4 |
Products include Github Cmark-Gfm, Gjtorikian Commonmarker.
How do I fix CVE-2024-22051?
Upgrade commonmarker to 0.23.4 or later.
Is CVE-2024-22051 being exploited?
There is no known exploitation of CVE-2024-22051 in the wild and no public exploit code.
Other vulnerabilities in github:cmark-gfm
- CVE-2023-37463 Quadratic complexity bugs may lead to a denial of service
- CVE-2023-24824 Quadratic complexity may lead to a denial of service in cmark-gfm
- CVE-2023-26485 Quadratic complexity may lead to a denial of service in cmark-gfm
- CVE-2023-22485 cmark-gfm out-of-bounds read in validate_protocol
- CVE-2023-22486 cmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of service
Sources
Also known as DEBIAN-CVE-2024-22051, GHSA-fmx4-26r3-wxpf, UBUNTU-CVE-2024-22051.