Debian Package Tracker
Register | Log in
Subscribe

cmark-gfm

CommonMark parsing and rendering program, GitHub flavor

Choose email to subscribe with

general
  • source: cmark-gfm (main)
  • version: 0.29.0.gfm.3-3
  • maintainer: Keith Packard (DMD)
  • arch: any
  • std-ver: 4.6.0.1
  • VCS: unknown
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • oldstable: 0.28.3.gfm.19-3
  • stable: 0.29.0.gfm.0-6
  • testing: 0.29.0.gfm.3-3
  • unstable: 0.29.0.gfm.3-3
versioned links
  • 0.28.3.gfm.19-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.29.0.gfm.0-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.29.0.gfm.3-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • cmark-gfm
  • libcmark-gfm-dev
  • libcmark-gfm-extensions-dev
  • libcmark-gfm-extensions0.29.0.gfm.3
  • libcmark-gfm0.29.0.gfm.3
action needed
A new upstream version is available: 0.29.0.gfm.4 high
A new upstream version 0.29.0.gfm.4 is available, you should consider packaging it.
Created: 2022-05-31 Last update: 2022-08-07 13:41
2 security issues in buster high

There are 2 open security issues in buster.

1 important issue:
  • CVE-2022-24724: cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing `table.c:row_from_string` may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where `cmark-gfm` is used. If `cmark-gfm` is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the `cmark-gfm` library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.
1 issue postponed or untriaged:
  • CVE-2020-5238: (needs triaging) The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.
Created: 2022-07-04 Last update: 2022-08-01 13:40
2 security issues in bullseye high

There are 2 open security issues in bullseye.

1 important issue:
  • CVE-2022-24724: cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing `table.c:row_from_string` may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where `cmark-gfm` is used. If `cmark-gfm` is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the `cmark-gfm` library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.
1 issue left for the package maintainer to handle:
  • CVE-2020-5238: (needs triaging) The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.

You can find information about how to handle this issue in the security team's documentation.

Created: 2022-07-04 Last update: 2022-08-01 13:40
lintian reports 2 errors and 4 warnings high
Lintian reports 2 errors and 4 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2022-07-30 Last update: 2022-07-30 12:12
Build log checks report 1 warning low
Build log checks report 1 warning
Created: 2018-10-24 Last update: 2019-04-23 02:06
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.1 instead of 4.6.0.1).
Created: 2022-05-11 Last update: 2022-05-11 23:24
news
[rss feed]
  • [2022-03-15] cmark-gfm 0.29.0.gfm.3-3 MIGRATED to testing (Debian testing watch)
  • [2022-03-12] Accepted cmark-gfm 0.29.0.gfm.3-3 (source amd64) into unstable, unstable (Debian FTP Masters) (signed by: Keith Packard)
  • [2022-01-24] cmark-gfm 0.29.0.gfm.2-2 MIGRATED to testing (Debian testing watch)
  • [2022-01-22] Accepted cmark-gfm 0.29.0.gfm.2-2 (source amd64) into unstable, unstable (Debian FTP Masters) (signed by: Keith Packard)
  • [2022-01-18] Accepted cmark-gfm 0.29.0.gfm.2-1 (source) into unstable (Keith Packard)
  • [2020-09-05] cmark-gfm 0.29.0.gfm.0-6 MIGRATED to testing (Debian testing watch)
  • [2020-09-02] Accepted cmark-gfm 0.29.0.gfm.0-6 (source) into unstable (Keith Packard)
  • [2020-08-28] Accepted cmark-gfm 0.29.0.gfm.0-5 (source) into unstable (Keith Packard)
  • [2020-03-12] cmark-gfm 0.29.0.gfm.0-4 MIGRATED to testing (Debian testing watch)
  • [2020-03-09] Accepted cmark-gfm 0.29.0.gfm.0-4 (source) into unstable (Keith Packard)
  • [2019-12-20] cmark-gfm 0.29.0.gfm.0-3 MIGRATED to testing (Debian testing watch)
  • [2019-12-17] Accepted cmark-gfm 0.29.0.gfm.0-3 (source) into unstable (Keith Packard)
  • [2019-12-17] Accepted cmark-gfm 0.29.0.gfm.0-2 (source) into unstable (Keith Packard)
  • [2019-04-22] Accepted cmark-gfm 0.29.0.gfm.0-1 (source amd64) into unstable (Keith Packard)
  • [2019-03-09] Accepted cmark-gfm 0.28.3.gfm.20-3 (source amd64) into unstable (Keith Packard)
  • [2019-03-09] Accepted cmark-gfm 0.28.3.gfm.20-2 (source amd64) into unstable (Keith Packard)
  • [2019-03-09] Accepted cmark-gfm 0.28.3.gfm.20-1 (source amd64) into unstable (Keith Packard)
  • [2018-10-26] cmark-gfm 0.28.3.gfm.19-3 MIGRATED to testing (Debian testing watch)
  • [2018-10-23] Accepted cmark-gfm 0.28.3.gfm.19-3 (source amd64) into unstable (Keith Packard)
  • [2018-10-23] Accepted cmark-gfm 0.28.3.gfm.19-2 (source amd64) into unstable (Keith Packard)
  • [2018-10-22] Accepted cmark-gfm 0.28.3.gfm.19-1 (source amd64) into unstable (Keith Packard)
  • [2018-10-15] cmark-gfm 0.28.3.gfm.17-1 MIGRATED to testing (Debian testing watch)
  • [2018-10-10] Accepted cmark-gfm 0.28.3.gfm.17-1 (source amd64) into unstable, unstable (Keith Packard)
bugs [bug history graph]
  • all: 0
links
  • homepage
  • lintian (2, 4)
  • buildd: logs, checks, clang, reproducibility, cross
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • screenshots
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 0.29.0.gfm.3-3

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing