ghsa-hgmg-hhc8-g5wr
Vulnerability from github
Published
2021-01-29 21:51
Modified
2022-08-11 18:16
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
CKEditor 5 Markdown plugin Regular expression Denial of Service
Details

Impact

A regular expression denial of service (ReDoS) vulnerability has been discovered in the CKEditor 5 Markdown plugin code. The vulnerability allowed to abuse a link recognition regular expression, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 Markdown plugin at version <= 24.0.0.

Patches

The problem has been recognized and patched. The fix will be available in version 25.0.0.

Workarounds

The user can work around the issue by: - Upgrading CKEditor 5 to version 25.0.0. - Disabling the Markdown plugin.

More information

If you have any questions or comments about this advisory: * Email us at security@cksource.com

Acknowledgements

The CKEditor 5 team would like to thank Erik Krogh Kristensen from the GitHub team for recognizing this vulnerability and Alvaro Muñoz from GitHub for reporting it.

Show details on source website

To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 24.0.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@ckeditor/ckeditor5-markdown-gfm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "25.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21254"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-01-29T21:50:43Z",
    "nvd_published_at": "2021-01-29T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nA regular expression denial of service (ReDoS) vulnerability has been discovered in the CKEditor 5 Markdown plugin code. The vulnerability allowed to abuse a link recognition regular expression, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 Markdown plugin at version \u003c= 24.0.0. \n\n### Patches\nThe problem has been recognized and patched. The fix will be available in version 25.0.0.\n\n### Workarounds\nThe user can work around the issue by:\n- Upgrading CKEditor 5 to version 25.0.0.\n- Disabling the Markdown plugin.\n\n### More information\nIf you have any questions or comments about this advisory:\n* Email us at [security@cksource.com](mailto:security@cksource.com)\n\n### Acknowledgements\nThe CKEditor 5 team would like to thank Erik Krogh Kristensen from the GitHub team for recognizing this vulnerability and \nAlvaro Mu\u00f1oz from GitHub for reporting it.",
  "id": "GHSA-hgmg-hhc8-g5wr",
  "modified": "2022-08-11T18:16:15Z",
  "published": "2021-01-29T21:51:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-hgmg-hhc8-g5wr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21254"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ckeditor/ckeditor5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ckeditor/ckeditor5/releases/tag/v25.0.0"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/@ckeditor/ckeditor5-markdown-gfm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CKEditor 5 Markdown plugin Regular expression Denial of Service"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.