Debian Package Tracker
Register | Log in
Subscribe

python-cmarkgfm

GitHub-flavored Markdown renderer Python bindings

Choose email to subscribe with

general
  • source: python-cmarkgfm (main)
  • version: 0.8.0-1
  • maintainer: Debian Python Team (DMD)
  • uploaders: Nicolas Dandrimont [DMD]
  • arch: any
  • std-ver: 4.6.0
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • oldstable: 0.4.2-1
  • stable: 0.4.2-1
  • testing: 0.8.0-1
  • unstable: 0.8.0-1
versioned links
  • 0.4.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.8.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • python3-cmarkgfm
action needed
A new upstream version is available: 2022.3.4 high
A new upstream version 2022.3.4 is available, you should consider packaging it.
Created: 2020-11-23 Last update: 2022-08-10 08:28
1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:
  • CVE-2020-5238: The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.
Created: 2022-07-04 Last update: 2022-08-01 13:40
2 security issues in buster high

There are 2 open security issues in buster.

1 important issue:
  • CVE-2022-24724: cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing `table.c:row_from_string` may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where `cmark-gfm` is used. If `cmark-gfm` is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the `cmark-gfm` library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.
1 issue postponed or untriaged:
  • CVE-2020-5238: (needs triaging) The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.
Created: 2022-07-04 Last update: 2022-08-01 13:40
2 security issues in bullseye high

There are 2 open security issues in bullseye.

1 important issue:
  • CVE-2022-24724: cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing `table.c:row_from_string` may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where `cmark-gfm` is used. If `cmark-gfm` is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the `cmark-gfm` library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.
1 issue left for the package maintainer to handle:
  • CVE-2020-5238: (needs triaging) The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.

You can find information about how to handle this issue in the security team's documentation.

Created: 2022-07-04 Last update: 2022-08-01 13:40
1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:
  • CVE-2020-5238: The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.
Created: 2022-07-04 Last update: 2022-08-01 13:40
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.1 instead of 4.6.0).
Created: 2022-05-11 Last update: 2022-05-11 23:24
news
[rss feed]
  • [2022-03-13] python-cmarkgfm 0.8.0-1 MIGRATED to testing (Debian testing watch)
  • [2022-03-11] python-cmarkgfm 0.7.0-1 MIGRATED to testing (Debian testing watch)
  • [2022-03-10] Accepted python-cmarkgfm 0.8.0-1 (source) into unstable (Carsten Schoenert)
  • [2022-03-07] Accepted python-cmarkgfm 0.7.0-1 (source) into unstable (Carsten Schoenert)
  • [2018-05-04] python-cmarkgfm 0.4.2-1 MIGRATED to testing (Debian testing watch)
  • [2018-05-01] Accepted python-cmarkgfm 0.4.2-1 (source amd64) into unstable, unstable (Nicolas Dandrimont)
bugs [bug history graph]
  • all: 2
  • RC: 0
  • I&N: 1
  • M&W: 1
  • F&P: 0
  • patch: 0
links
  • homepage
  • lintian
  • buildd: logs, clang, reproducibility, cross
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 0.8.0-1

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing