CVE-2023-28631: 
Rust vulnerability analysis and mitigation

Comrak, a CommonMark + GFM compatible Markdown parser and renderer written in Rust, was found to contain a vulnerability (CVE-2023-28631) that affects versions prior to 0.17.0. The vulnerability was discovered and disclosed in March 2023, impacting the AST (Abstract Syntax Tree) handling functionality of the software (GitHub Advisory, NVD).

The vulnerability stems from improper validation of data in AST nodes. When a Comrak AST is constructed manually by a program instead of parsing a Markdown document with parsedocument, and then converted to HTML via html::formatdocumentwithplugins, the HTML formatting code assumes the AST is well-formed. Many AST nodes contain [u8] fields which the formatting code assumes is valid UTF-8 data, but this assumption is not validated, leading to potential security issues (GitHub Advisory). The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (NVD).

If exploited, this vulnerability could allow an attacker to trigger several bugs by providing malformed UTF-8 data in AST nodes. The impact primarily affects the availability of the system, as indicated by the CVSS metrics showing no impact on confidentiality or integrity, but a low impact on availability (GitHub Advisory).

The primary mitigation is to upgrade to version 0.17.0 or later, which contains adjustments to the AST, storing strings instead of unvalidated byte arrays. For users unable to upgrade, a workaround is available: manually validate UTF-8 correctness of all data when assigning to &[u8] and Vec fields in the AST (GitHub Advisory).

The vulnerability has been acknowledged and addressed by multiple Linux distributions, including Fedora, which has released security updates to address this issue in their packages (Fedora Update).