Hi Yadd, On Wed, Jul 13, 2022 at 09:14:56PM +0200, Yadd wrote: > On 13/07/2022 08:38, Salvatore Bonaccorso wrote: > > Source: node-moment > > Version: 2.29.3+ds-1 > > Severity: grave > > Tags: security upstream > > X-Debbugs-Cc: car...@debian.org, Debian Security Team > > <t...@security.debian.org> > > > > Hi, > > > > The following vulnerability was published for node-moment. > > > > CVE-2022-31129[0]: > > | moment is a JavaScript date library for parsing, validating, > > | manipulating, and formatting dates. Affected versions of moment were > > | found to use an inefficient parsing algorithm. Specifically using > > | string-to-date parsing in moment (more specifically rfc2822 parsing, > > | which is tried by default) has quadratic (N^2) complexity on specific > > | inputs. Users may notice a noticeable slowdown is observed with inputs > > | above 10k characters. Users who pass user-provided strings without > > | sanity length checks to moment constructor are vulnerable to (Re)DoS > > | attacks. The problem is patched in 2.29.4, the patch can be applied to > > | all affected versions with minimal tweaking. Users are advised to > > | upgrade. Users unable to upgrade should consider limiting date lengths > > | accepted from user input. > > > > > > If you fix the vulnerability please also make sure to include the > > CVE (Common Vulnerabilities & Exposures) id in your changelog entry. > > Hi, > > here is the debdiff
Thanks! I think it should be enough IMHO as well in this case to push the fix out via the next bullseye point release (now though a couple of weeks away as the counter restarted). Thank you for your work! Salvatore