Is CVE-2017-17461 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-17461 being exploited in the wild.

How severe is CVE-2017-17461?

Informational severity, published 4 January 2018.

Which products and versions are affected?

marked (npm) SEMVER:introduced=0,fixed=0.3.9.

Is there a fix for CVE-2017-17461?

Yes. marked (npm): upgrade to 0.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-17461 attacked?

It is attacked over the network.

Am I affected by CVE-2017-17461?

Check whether you run marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-17461: marked ReDoS vulnerability in regular expression parsing

CVE-2017-17461 · Severity: info · Published 2018-01-04

marked is a popular JavaScript library used to convert Markdown text into HTML. A regular expression denial-of-service (ReDoS) flaw in earlier versions could allow an attacker to crash servers or applications by submitting specially crafted Markdown strings, causing performance degradation or service unavailability. However, this advisory was withdrawn in 2021 after further investigation determined it was not actually a security issue.

Technologies: marked (npm). Vendors: npm.

Quick answers

Is CVE-2017-17461 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-17461 being exploited in the wild.
How severe is CVE-2017-17461?: Informational severity, published 4 January 2018.
Which products and versions are affected?: marked (npm) SEMVER:introduced=0,fixed=0.3.9.
Is there a fix for CVE-2017-17461?: Yes. marked (npm): upgrade to 0.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-17461 attacked?: It is attacked over the network.
Am I affected by CVE-2017-17461?: Check whether you run marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

marked (npm): upgrade to 0.3.9 or later
```
npm install marked@0.3.9
```

Technical details

The vulnerability was reported as a ReDoS flaw in the marked.js file, where maliciously crafted input could trigger excessive regular expression backtracking and cause denial of service. The issue affected marked versions prior to 0.3.9, with a patch released in version 0.3.9. The advisory was withdrawn on December 2, 2021, per the NVD's determination that "further investigation showed that it was not a security issue," indicating the reported ReDoS condition was either not reproducible or not actually exploitable in practice.

Affected products

marked marked < 0.3.9

Identifiers

CVE-2017-17461
GHSA-crmx-v835-hcp4

Timeline

2018-01-04: disclosed
2018: patched: patch released in version 0.3.9
2021-12-02: other: advisory withdrawn; further investigation showed it was not a security issue

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.