CVE-2020-5238: fedoraproject fedora Improper Input Validation
Vulnerability summary
CVE-2020-5238 is a medium (CVSS 6.5) Improper Input Validation vulnerability in fedoraproject fedora. EPSS estimates a 1.57% chance of exploitation in the next 30 days, higher than 74.9% of scored vulnerabilities.
Timeline
- 01-07-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.57%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
0.00 pp
From 1.57% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian5 products
- cmark-gfm< 0.29.0.gfm.2-1
- haskell-cmark-gfm< 0.2.1+ds1-1
- python-cmarkgfm< 0.7.0-1
- r-cran-commonmark< 1.8.0-1
- ruby-commonmarker< 0.21.0-1
Ubuntu5 products
- cmark-gfmAll versions (No fix recorded)
- haskell-cmark-gfmAll versions (No fix recorded)
- python-cmarkgfmAll versions (No fix recorded)
- r-cran-commonmarkAll versions (No fix recorded)
- ruby-commonmarkerAll versions (No fix recorded)
Redhat2 products
- pandoc< 0:2.0.6-5.el8
- pandoc-common< 0:2.0.6-5.el8
Fedoraproject1 product
- fedoraEOL31 | 32 | 33
Github1 product
- cmark-gfm< 0.29.0.gfm.1
Github_flavored_markdown_project1 product
- github_flavored_markdown< 0.29.0.gfm.1
6 vendors · 15 products
References
15 links- github.com/github/cmark-gfm/security/advisories/GHSA-7gc6-9qr5-hc85X Refsource CONFIRMREPORTThird Party Advisory
- github.com/github/cmark-gfm/commit/85d895289c5ab67f988ca659493a64abb5fec7b4X Refsource MISCREPORTPatchThird Party Advisory
