{"action":"Upgrade kramdown to 2.3.0 or later.","affected":[{"fixed":"2.3.0","introduced":"0"}],"component":"kramdown","cve_ids":["CVE-2020-14001"],"ecosystem":"RubyGems","epss":0.0456,"exploited":false,"fixed_versions":["2.3.0"],"ghsa_id":"GHSA-mqm2-cgpr-p4m6","id":"tcs_01M5KEMAS43K817CVHGP0R2K6F","modified_at":"2024-02-18T05:27:22.932897Z","published_at":"2020-08-07T22:27:41Z","references":["https://osv.dev/vulnerability/GHSA-mqm2-cgpr-p4m6","https://nvd.nist.gov/vuln/detail/CVE-2020-14001","https://github.com/gettalong/kramdown/commit/1b8fd33c3120bfc6e5164b449e2c2fc9c9306fde","https://github.com/advisories/GHSA-mqm2-cgpr-p4m6","https://github.com/gettalong/kramdown","https://github.com/gettalong/kramdown/compare/REL_2_2_1...REL_2_3_0","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/kramdown/CVE-2020-14001.yml","https://kramdown.gettalong.org","https://kramdown.gettalong.org/news.html","https://lists.apache.org/thread.html/r96df7899fbb456fe2705882f710a0c8e8614b573fbffd8d12e3f54d2@%3Cnotifications.fluo.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/08/msg00014.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ENMMGKHRQIZ3QKGOMBBBGB6B4LB5I7NQ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KBLTGBYU7NKOUOHDKVCU4GFZMGA6BP4L","https://rubygems.org/gems/kramdown","https://security.netapp.com/advisory/ntap-20200731-0004","https://usn.ubuntu.com/4562-1","https://www.debian.org/security/2020/dsa-4743"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-mqm2-cgpr-p4m6","url":"https://osv.dev/vulnerability/GHSA-mqm2-cgpr-p4m6"}],"summary":"Unintended read access in kramdown gem"}