CVE-2020-26307

HTML2Markdown is a Javascript implementation for converting HTML to Markdown text. All available versions contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.

CVSS

No CVSS.

References

Link	Resource
https://github.com/kates/html2markdown/issues/13
https://securitylab.github.com/advisories/GHSL-2020-301-redos-HTML2Markdown/

Configurations

No configuration.

History

28 Oct 2024, 13:58

Type	Values Removed	Values Added
Summary		(es) HTML2Markdown es una implementación de Javascript para convertir HTML en texto Markdown. Todas las versiones disponibles contienen una o más expresiones regulares que son vulnerables a la denegación de servicio por expresión regular (ReDoS). Al momento de la publicación, no se conocían parches disponibles.

26 Oct 2024, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-26 21:15

Updated : 2024-10-28 13:58

NVD link : CVE-2020-26307

Mitre link : CVE-2020-26307

CVE.ORG link : CVE-2020-26307

JSON object : View

Products Affected

No product.

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2020-26307", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 8.7, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "NONE", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "NONE", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-10-26T21:15:13.980", "references": [{"url": "https://github.com/kates/html2markdown/issues/13", "source": "security-advisories@github.com"}, {"url": "https://securitylab.github.com/advisories/GHSL-2020-301-redos-HTML2Markdown/", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "HTML2Markdown is a Javascript implementation for converting HTML to Markdown text. All available versions contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available."}, {"lang": "es", "value": "HTML2Markdown es una implementaci\u00f3n de Javascript para convertir HTML en texto Markdown. Todas las versiones disponibles contienen una o m\u00e1s expresiones regulares que son vulnerables a la denegaci\u00f3n de servicio por expresi\u00f3n regular (ReDoS). Al momento de la publicaci\u00f3n, no se conoc\u00edan parches disponibles."}], "lastModified": "2024-10-28T13:58:09.230", "sourceIdentifier": "security-advisories@github.com"}