CVE-2021-26813 : markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial

markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.

Published 2021-03-03 16:15:13

Updated 2022-05-23 16:00:15

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2021-26813

Fedoraproject » Fedora » Version: 32
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 33
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 34
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Matching versions
Markdown2 Project » Markdown2
Versions from including (>=) 1.0.1.18 and before (<) 2.4.0
cpe:2.3:a:markdown2_project:markdown2:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-26813

EPSS FAQ

0.30%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 66 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-26813

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

References for CVE-2021-26813

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JTIX5UXRDJZJ57DO4V33ZNJTNKWGBQLY/

[SECURITY] Fedora 34 Update: python-markdown2-2.4.0-1.fc34 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRP5RN35JZTSJ3JT4722F447ZDK7LZS5/

[SECURITY] Fedora 32 Update: python-markdown2-2.4.0-1.fc32 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J752422YELXLMLZJPVJVKD2KKHHQRVEH/

[SECURITY] Fedora 33 Update: python-markdown2-2.4.0-1.fc33 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://github.com/trentm/python-markdown2/pull/387

Regex DOS fixes by nicholasserra · Pull Request #387 · trentm/python-markdown2 · GitHub
Exploit;Third Party Advisory

Jump to

Vulnerability Details : CVE-2021-26813

Products affected by CVE-2021-26813

Exploit prediction scoring system (EPSS) score for CVE-2021-26813

CVSS scores for CVE-2021-26813

References for CVE-2021-26813