CVE-2020-26148

Advisory

Md4c (Python bindings) v1.0.0 includes a fix for 'ISANYOF' macro, which is vulnerable in md4c main package versions before 0.4.6: The mentioned macro could provide unexpected results when encountering zero byte in the input text; in some cases leading to broken internal state of the parser. The bug could result in a denial of service and possibly also in other security implications.
https://github.com/mity/md4c/issues/130

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Fixes:

* [130](https://github.com/mity/md4c/issues/130):
Fix `ISANYOF` macro, which could provide unexpected results when encountering
zero byte in the input text; in some cases leading to broken internal state
of the parser.

The bug could result in denial of service and possibly also to other security
implications. Applications are advised to update to 0.4.6.

Resources

• https://pypi.org/project/md4c
• https://pyup.io/changelogs/md4c/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26148