CVE-2022-31129: Moment.js vulnerable to Inefficient Regular Expression Complexity
(updated )
- using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs
- noticeable slowdown is observed with inputs above 10k characters
- users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks
References
- github.com/advisories/GHSA-wc69-rhjr-hc9g
- github.com/moment/moment
- github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3
- github.com/moment/moment/pull/6015
- github.com/moment/moment/pull/6015/commits/4bbb9f3ccbe231de40207503f344fe5ce97584f4
- github.com/moment/moment/pull/6015/commits/bfd4f2375d5c1a2106246721d693a9611dddfbfe
- github.com/moment/moment/pull/6015/commits/dc0d180e90d8a84f7ff13572363330a22b3ea504
- github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g
- huntr.dev/bounties/f0952b67-f2ff-44a9-a9cd-99e0a87cb633
- lists.debian.org/debian-lts-announce/2023/01/msg00035.html
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWY24RJA3SBJGA5N4CU4VBPHJPPPJL5O
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMX5YHELQVCGKKQVFXIYOTBMN23YYSRO
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IWY24RJA3SBJGA5N4CU4VBPHJPPPJL5O
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZMX5YHELQVCGKKQVFXIYOTBMN23YYSRO
- nvd.nist.gov/vuln/detail/CVE-2022-31129
- security.netapp.com/advisory/ntap-20221014-0003
- security.netapp.com/advisory/ntap-20241108-0002
Code Behaviors & Features
Detect and mitigate CVE-2022-31129 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →