Upstream information

CVE-2024-44337 at MITRE

Description

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `v0.0.0-20240729232818-a2a9c4f`, which corresponds with commit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252`, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252` contains fixes to this problem.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v3 Scores
CVSS detail CNA (CISA-ADP)
Base Score 5.1
Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact None
Integrity Impact Low
Availability Impact Low
CVSSv3 Version 3.1
SUSE Bugzilla entry: 1231713 [NEW]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
Container bci/bci-busybox:16.0
Container rancher/elemental-channel/sl-micro:6.2-baremetal-8.2
Container rancher/elemental-channel/sl-micro:6.2-base-8.2
Container rancher/elemental-channel/sl-micro:6.2-kvm-8.2
Container rancher/elemental-channel/sl-micro:6.2-rt-8.2
Container suse/sl-micro/6.2/baremetal-iso-image:latest
Container suse/sl-micro/6.2/base-iso-image:latest
Container suse/sl-micro/6.2/kvm-iso-image:latest
Container suse/sl-micro/6.2/rt-iso-image:latest
  • busybox >= 1.37.0-160000.3.1
Container suse/sl-micro/6.0/baremetal-os-container:latest
Container suse/sl-micro/6.0/toolbox:latest
Image SL-Micro
Image SL-Micro-Base
Image SL-Micro-Base-RT
Image SL-Micro-Base-RT-SelfInstall
Image SL-Micro-Base-RT-encrypted
Image SL-Micro-Base-SelfInstall
Image SL-Micro-Base-encrypted
Image SL-Micro-Base-qcow
Image SL-Micro-Default
Image SL-Micro-Default-SelfInstall
Image SL-Micro-Default-encrypted
Image SL-Micro-Default-qcow
  • less >= 633-3.1
Image SLE-Micro-Azure
Image SLE-Micro-BYOS-Azure
  • cloud-netconfig-azure >= 1.15-slfo.1.1_1.1
  • less >= 633-3.1
Image SLE-Micro-BYOS-GCE
Image SLE-Micro-GCE
  • cloud-netconfig-gce >= 1.15-slfo.1.1_1.1
  • less >= 633-3.1
Image SLE-Micro
Image SLE-Micro-BYOS
Image SLE-Micro-BYOS-EC2
Image SLE-Micro-EC2
  • cloud-netconfig-ec2 >= 1.15-slfo.1.1_1.1
  • less >= 633-3.1
Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure
Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2
Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE
  • mgrpxy >= 5.1.27-slfo.1.1.1
  • mgrpxy-bash-completion >= 5.1.27-slfo.1.1.1
  • suse-multi-linux-manager-5.1-x86_64-proxy-httpd-image >= 5.1.3.1-8.19.2
  • suse-multi-linux-manager-5.1-x86_64-proxy-salt-broker-image >= 5.1.3.1-9.17.3
  • suse-multi-linux-manager-5.1-x86_64-proxy-squid-image >= 5.1.3.1-8.17.2
  • suse-multi-linux-manager-5.1-x86_64-proxy-ssh-image >= 5.1.3.1-8.17.2
  • suse-multi-linux-manager-5.1-x86_64-proxy-tftpd-image >= 5.1.3.1-8.17.2
Image SUSE-Multi-Linux-Manager-Server-Azure-llc
Image SUSE-Multi-Linux-Manager-Server-Azure-ltd
Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure
Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2
Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE
Image SUSE-Multi-Linux-Manager-Server-EC2-llc
Image SUSE-Multi-Linux-Manager-Server-EC2-ltd
  • mgradm >= 5.1.27-slfo.1.1.1
  • mgradm-bash-completion >= 5.1.27-slfo.1.1.1
  • mgradm-lang >= 5.1.27-slfo.1.1.1
  • mgrctl >= 5.1.27-slfo.1.1.1
  • mgrctl-bash-completion >= 5.1.27-slfo.1.1.1
  • mgrctl-lang >= 5.1.27-slfo.1.1.1
  • suse-multi-linux-manager-5.1-x86_64-server-attestation-image >= 5.1.3.1-8.19.2
  • suse-multi-linux-manager-5.1-x86_64-server-hub-xmlrpc-api-image >= 5.1.3.1-8.17.2
  • suse-multi-linux-manager-5.1-x86_64-server-image >= 5.1.3.1-8.17.2
  • suse-multi-linux-manager-5.1-x86_64-server-migration-14-16-image >= 5.1.3.1-8.17.2
  • suse-multi-linux-manager-5.1-x86_64-server-postgresql-image >= 5.1.3.1-6.19.1
  • suse-multi-linux-manager-5.1-x86_64-server-saline-image >= 5.1.3.1-9.17.3
SUSE Linux Enterprise Server 16.0
  • govulncheck-vulndb >= 0.0.20250814T182633-160000.1.2
 Patchnames:
SUSE Linux Enterprise Server 16.0 GA govulncheck-vulndb-0.0.20250814T182633-160000.1.2 (aarch64,ppc64le,s390x,x86_64)
SUSE Linux Enterprise Server 16.1
  • govulncheck-vulndb >= 0.0.20260916T180043-160100.1.1
 Patchnames:
SUSE Linux Enterprise Server 16.1 GA govulncheck-vulndb-0.0.20260916T180043-160100.1.1 (aarch64,ppc64le,s390x,x86_64)
SUSE Linux Enterprise Server for SAP applications 16.0
  • govulncheck-vulndb >= 0.0.20250814T182633-160000.1.2
 Patchnames:
SUSE Linux Enterprise Server for SAP applications 16.0 GA govulncheck-vulndb-0.0.20250814T182633-160000.1.2 (aarch64,ppc64le,s390x,x86_64)
SUSE Linux Enterprise Server for SAP applications 16.1
  • govulncheck-vulndb >= 0.0.20260916T180043-160100.1.1
 Patchnames:
SUSE Linux Enterprise Server for SAP applications 16.1 GA govulncheck-vulndb-0.0.20260916T180043-160100.1.1 (aarch64,ppc64le,s390x,x86_64)
openSUSE Tumbleweed
  • fq >= 0.14.0-1.1
  • govulncheck-vulndb >= 0.0.20241213T205935-1.1
 Patchnames:
openSUSE-Tumbleweed-2024-14599
openSUSE-Tumbleweed-2025-14753

SUSE Timeline for this CVE

CVE page created: Wed Oct 16 00:00:15 2024
CVE page last modified: Wed Oct 28 15:24:28 2026