Published: 19/03/2021 Updated: 07/11/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Kramdown prior to 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

Vulnerable Product	Search on Vulmon	Subscribe to Product
kramdown project kramdown
fedoraproject fedora 32
fedoraproject fedora 33
fedoraproject fedora 34
debian debian linux 10.0

Debian Bug report logs - #985569 ruby-kramdown: CVE-2021-28834 Package: src:ruby-kramdown; Maintainer for src:ruby-kramdown is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 20 Mar 2021 07:54:02 UTC Severity: grave ...

Stan Hu discovered that kramdown, a pure Ruby Markdown parser and converter, performed insufficient namespace validation of Rouge syntax highlighting formatters For the stable distribution (buster), this problem has been fixed in version 1170-1+deb10u2 We recommend that you upgrade your ruby-kramdown packages For the detailed security status o ...

Kramdown before 231 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated This causes a security issue in GitLab CE/EE affecting all versions starting from 132, allowing unauthorised authenticated users to execute arbitrary code on the server ...

NVD-CWE-noinfo https://github.com/gettalong/kramdown/pull/708 https://github.com/gettalong/kramdown/compare/REL_2_3_0...REL_2_3_1 https://gitlab.com/gitlab-org/gitlab/-/commit/179329b5c3c118924fb242dc449d06b4ed6ccb66 https://www.debian.org/security/2021/dsa-4890 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S3BBLUIDCUUR3NEE4NJLOCCAV3ALQ3O6/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYOLQKFL6IJCQLBXV34Z4TI4O54GESPR/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJCJVYHPY6LNUFM6LYZIAUIYOMVT5QGV/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985569 https://nvd.nist.gov https://www.debian.org/security/2021/dsa-4890

CVE-2021-28834

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect