جزئیات آسیب‌پذیری
CVE-2025-69534
Red Hat Ansible Automation Platform 2Red Hat OpenShift AIRed Hat Satellite 6
CVSS 3.1
8.2بالا
شرح رسمی (انگلیسی)
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.5بالا | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 8.2بالا | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Satellite 6 | همه | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۲۰- https://github.com/Python-Markdown/markdown/issues/1534
- https://github.com/Python-Markdown/markdown
- https://github.com/Python-Markdown/markdown/actions/runs/15736122892
- http://www.openwall.com/lists/oss-security/2026/03/06/4
- https://access.redhat.com/security/cve/CVE-2025-69534 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2444839 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69534.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:13512 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14874 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13508 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14873 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14835 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20677 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19155 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20674 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20676 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19366 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9742 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13826 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10184 vendor-advisoryx_refsource_REDHAT
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۱۲/۱۴
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۱۶
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- mitre
پیش‌بینی بهره‌برداری (EPSS)
۰٫۶۶٪
احتمال بهره‌برداری در ۳۰ روز
۵۱٫۸٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهره‌برداری
- اثبات مفهوم
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-400Uncontrolled Resource Consumption
- CWE-617Reachable Assertion