[Pkg-javascript-devel] Bug#1014845: node-moment: CVE-2022-31129

[Salvatore Bonaccorso]

Source: node-moment
Version: 2.29.3+ds-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for node-moment.

CVE-2022-31129[0]:
| moment is a JavaScript date library for parsing, validating,
| manipulating, and formatting dates. Affected versions of moment were
| found to use an inefficient parsing algorithm. Specifically using
| string-to-date parsing in moment (more specifically rfc2822 parsing,
| which is tried by default) has quadratic (N^2) complexity on specific
| inputs. Users may notice a noticeable slowdown is observed with inputs
| above 10k characters. Users who pass user-provided strings without
| sanity length checks to moment constructor are vulnerable to (Re)DoS
| attacks. The problem is patched in 2.29.4, the patch can be applied to
| all affected versions with minimal tweaking. Users are advised to
| upgrade. Users unable to upgrade should consider limiting date lengths
| accepted from user input.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-31129
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31129
[1] https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g
[2] https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore