[Pkg-javascript-devel] Bug#1014845: Bug#1014845: node-moment: CVE-2022-31129

[Salvatore Bonaccorso]

Hi Yadd,

On Wed, Jul 13, 2022 at 09:14:56PM +0200, Yadd wrote:
> On 13/07/2022 08:38, Salvatore Bonaccorso wrote:
> > Source: node-moment
> > Version: 2.29.3+ds-1
> > Severity: grave
> > Tags: security upstream
> > X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
> > 
> > Hi,
> > 
> > The following vulnerability was published for node-moment.
> > 
> > CVE-2022-31129[0]:
> > | moment is a JavaScript date library for parsing, validating,
> > | manipulating, and formatting dates. Affected versions of moment were
> > | found to use an inefficient parsing algorithm. Specifically using
> > | string-to-date parsing in moment (more specifically rfc2822 parsing,
> > | which is tried by default) has quadratic (N^2) complexity on specific
> > | inputs. Users may notice a noticeable slowdown is observed with inputs
> > | above 10k characters. Users who pass user-provided strings without
> > | sanity length checks to moment constructor are vulnerable to (Re)DoS
> > | attacks. The problem is patched in 2.29.4, the patch can be applied to
> > | all affected versions with minimal tweaking. Users are advised to
> > | upgrade. Users unable to upgrade should consider limiting date lengths
> > | accepted from user input.
> > 
> > 
> > If you fix the vulnerability please also make sure to include the
> > CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> Hi,
> 
> here is the debdiff

Thanks! I think it should be enough IMHO as well in this case to push
the fix out via the next bullseye point release (now though a couple
of weeks away as the counter restarted).

Thank you for your work!

Salvatore