Source: node-moment Version: 2.29.3+ds-1 Severity: grave Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for node-moment. CVE-2022-31129[0]: | moment is a JavaScript date library for parsing, validating, | manipulating, and formatting dates. Affected versions of moment were | found to use an inefficient parsing algorithm. Specifically using | string-to-date parsing in moment (more specifically rfc2822 parsing, | which is tried by default) has quadratic (N^2) complexity on specific | inputs. Users may notice a noticeable slowdown is observed with inputs | above 10k characters. Users who pass user-provided strings without | sanity length checks to moment constructor are vulnerable to (Re)DoS | attacks. The problem is patched in 2.29.4, the patch can be applied to | all affected versions with minimal tweaking. Users are advised to | upgrade. Users unable to upgrade should consider limiting date lengths | accepted from user input. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2022-31129 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31129 [1] https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g [2] https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3 Please adjust the affected versions in the BTS as needed. Regards, Salvatore