Back

HIGH

rubygem-asciidoctor: Infinite loop in the #next_block method

Published Oct 16, 2018

Description

Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.

Affected products

Remediation

Red Hat statement

The version of rubygem-asciidoctor included in Red Hat Virtualization is affected by this flaw, however it is not exposed to user input in such a way that the vulnerability could be exploited by an attacker.

Metrics

Weaknesses (1)

References (7)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Oct 16, 2018
Updated Aug 5, 2024
Reserved Oct 16, 2018
NVD
Status Modified
Modified Jun 17, 2026
Red Hat
Severity Moderate
Public date Sep 26, 2018
GHSA-QC9P-MJXM-J2WJ