-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: pandoc security update Advisory ID: RHSA-2022:5597-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:5597 Issue date: 2022-07-18 CVE Names: CVE-2022-24724 ==================================================================== 1. Summary: An update for pandoc is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat CodeReady Linux Builder (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Pandoc is a markdown/markup conversion tool. The version of pandoc in RHEL 8 CRB uses cmark-gfm (GitHub's extended version of the C reference implementation of CommonMark) for parts of its conversion. The update, fixes CVE-2022-24724: an integer overflow in cmark-gfm's table row parsing which may lead to heap memory corruption when parsing tables with more than UINT16_MAX columns. Security Fix(es): * cmark-gfm: possible RCE due to integer overflow (CVE-2022-24724) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2060662 - CVE-2022-24724 cmark-gfm: possible RCE due to integer overflow 6. Package List: Red Hat CodeReady Linux Builder (v. 8): Source: pandoc-2.0.6-6.el8_6.src.rpm aarch64: pandoc-2.0.6-6.el8_6.aarch64.rpm noarch: pandoc-common-2.0.6-6.el8_6.noarch.rpm ppc64le: pandoc-2.0.6-6.el8_6.ppc64le.rpm s390x: pandoc-2.0.6-6.el8_6.s390x.rpm x86_64: pandoc-2.0.6-6.el8_6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-24724 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYuFkC9zjgjWX9erEAQiiJA/8DMprplAk7l4hD53FuNxy5kp1Zk1eQjqR fl/MHjIejiRD4/Rk5GrKNip2P97tCMFzn+NAhjyBlIKCuiJKUuSMl/OHvLHJA9D7 RyKZnqqewYZY/fBpi5DN1IfPSVR4bFZeVsmPK0hvK85vkK7nhByd5QQ7q53D3nCR jQxU1VBt23wkZGVkeE93ElsZeh5G+4LecOPD4MAmiurq9zDlpM/8uTYhdCmLom3X aC/mXDu9SyvI5zYGfXYzW/vmnqaSARX5BIdxgkRkuitBYZ4y4LL8ipQxDmhaDUEt QGg5fcZqUWL557Lupg0A2dCFhgFBwmimtdpZanIiSVYd9lKAvgExb1tou0Ip9hzT PomTiqfHfg9qxnyNayrpSWao/qE+pwWjo2hZJrMAVUUZR1WhWVfKH8pf2duto2X3 O/IwZYmOP8utBiYPZ2A/Q+xLH752cnOfJWZEPMu4dS+Mo+PteZYLyCcE7+2w16qY q6ZccjeBdo7kJZu1dYlllDSMPL97Z5Z3SZK/USvgNoCQpZQAqt/94VKZkaPwySrJ 805OBag7GhtfIg5v4ul43dKBNbq3+QXxcwa4zv4DTJ0fNEgo/rDoZ4ysN+eSPLyS aOFiva8E9a5c6PBiSOV3zI6sAkQz1g8VfxdcDZRQKDResUoSwMb52H0Fk+Z0ACLc VjOk/nbwCE0=Kjz5 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce