EIQ-2019-0024
|
ID |
EIQ-2019-0024 |
|
CVE |
- |
|
Description |
marked is vulnerable to regular expression denial of service |
|
Date |
29 Apr 2019 |
|
Severity |
2 - MEDIUM |
|
CVSSv3 score |
CVSSv3 score not available on NIST NVD. |
|
Status |
|
|
Assessment |
marked versions 0.3.14 and later, and versions 0.6.1 and earlier, is vulnerable to regular expression denial of service (ReDoS). It may take quadratic time for the inline.text regex to scan for possible email addresses. |
|
Mitigation |
Upgrade marked to version 0.6.2 or later. |
|
Affected versions |
2.3.4 and 2.4.0 |
|
Notes |
For more information, see: |
2.5.0< Back to all security issues and mitigation actions
In release notes 2.4.0
In release notes 2.5.0