[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2022-31129Date: (C)2022-07-08   (M)2024-02-09


moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : 7.5CVSS Score : 5.0
Exploit Score: 3.9Exploit Score: 10.0
Impact Score: 3.6Impact Score: 2.9
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: NETWORKAccess Vector: NETWORK
Attack Complexity: LOWAccess Complexity: LOW
Privileges Required: NONEAuthentication: NONE
User Interaction: NONEConfidentiality: NONE
Scope: UNCHANGEDIntegrity: NONE
Confidentiality: NONEAvailability: PARTIAL
Integrity: NONE 
Availability: HIGH 
  
Reference:
FEDORA-2022-35b698150c
FEDORA-2022-798fd95813
FEDORA-2022-85aa8e5706
FEDORA-2022-b9ef7c3c3c
https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html
https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3
https://github.com/moment/moment/pull/6015#issuecomment-1152961973
https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g
https://huntr.dev/bounties/f0952b67-f2ff-44a9-a9cd-99e0a87cb633/
https://security.netapp.com/advisory/ntap-20221014-0003/

OVAL    6
oval:org.secpod.oval:def:124160
oval:org.secpod.oval:def:707668
oval:org.secpod.oval:def:88570
oval:org.secpod.oval:def:123632
...

© SecPod Technologies