Описание
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when restrict_base_path: True, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.
A flaw was found in PyMdown Extensions, a tool used for processing Markdown documents. This vulnerability allows an attacker to potentially read sensitive files from unexpected locations on a system. By crafting a special Markdown snippet, an attacker could trick the system into accessing files outside of the intended directory, leading to unauthorized information disclosure. This issue requires user interaction, meaning a user would need to process a malicious Markdown file for the attack to succeed.
Отчет
Red Hat ships pymdown-extensions in several products as a bundled dependency. The vulnerability requires an attacker to control Markdown content processed by the pymdownx.snippets extension and for sibling directories with a matching path prefix to exist. While the vulnerable versions are present, the practical exploitability depends on whether untrusted Markdown input is processed in the affected products.
Меры по смягчению последствий
Ensure that untrusted Markdown content is not processed by the pymdownx.snippets extension. If the snippets feature is not required, it can be disabled in the MkDocs or Python-Markdown configuration.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Developer Hub | rhdh/rhdh-hub-rhel9 | Fix deferred | ||
| Red Hat Hardened Images | trivy | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-olm-catalogd-rhel9 | Fix deferred | ||
| Self-service automation portal 2 | ansible-automation-platform/bootc-automation-portal-rhel9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS3
Связанные уязвимости
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.
PyMdown Extensions is a set of extensions for the Python-Markdown mark ...
Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path
EPSS
4.3 Medium
CVSS3