The Patching Friars' AlmanacA calendar of CVE saints

January 18

MarkDownTimeHoly card for markdowntime, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 # ** MarkDownTime FESTINA LENTE
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint MarkDownTime, Who Paused the READMEs

Patron of overlong Markdown tables, parsers that think too hard, and CPUs at 100%.

Life

Found by Legit Security and described in January 2023, he lived in Markdown libraries used by GitLab and countless projects. A carefully crafted text made the parser work for a disproportionate time, keeping the CPU busy until the service stopped. One well-written issue was enough for an afternoon of downtime.

Prayer

O Saint MarkDownTime, who turns an asterisk into an eternity, grant our parsers linear complexity. Amen.

How to celebrate

Celebrated by updating Markdown libraries and, as penance, writing a README without tables.

Write too much and everyone waits.

Technical record

Disclosed on
January 18 2023
CVE
CVE-2022-2931CVE-2022-39209
CVSS
7.5
Product
GitLab · GitLab

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Malformed content added to the issue description could have been used to trigger high CPU usage.

Sources: legitsecurity.com

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.