CVE-2023-22467
See a problem?- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-22467
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-22467.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-22467
- Aliases
- Published
- 2023-01-04T22:15:09Z
- Modified
- 2024-05-30T03:59:47.836457Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.
- References
-
- https://github.com/moment/luxon/security/advisories/GHSA-3xq5-wjfh-ppjc
- https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g
- https://github.com/moment/luxon/commit/5ab3bf64a10da929a437629cdb2f059bb83212bf
- https://github.com/moment/moment/pull/6015#issuecomment-1152961973
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/44I3WAJKYXDLOVYRGMHAUXMIV4SPFXDZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LIVOASKBQH7FEUI5RWM3SOHR6VK7ZZR/
Affected packages
Git / github.com/moment/luxon
Affected ranges
- Type
- GIT
- Repo
- https://github.com/moment/luxon
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
0.*
0.0.18
0.0.19
0.0.20
0.0.22
0.1.0
0.2.0
0.2.1
0.2.10
0.2.11
0.2.12
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.3.0
0.3.1
0.4.0
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.8
1.*
1.0.0
1.1.0
1.10.0
1.11.0
1.11.1
1.11.2
1.11.3
1.11.4
1.12.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.16.1
1.17.0
1.17.1
1.17.2
1.17.3
1.18.0
1.18.1
1.19.0
1.19.1
1.19.2
1.19.3
1.2.0
1.2.1
1.20.0
1.21.1
1.21.2
1.21.3
1.22.0
1.22.1
1.22.2
1.23.0
1.24.0
1.24.1
1.25.0
1.26.0
1.27.0
1.28.0
1.3.0
1.3.1
1.3.2
1.3.3
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.1
1.8.2
1.8.3
1.9.0
2.*
2.0.0
2.0.1
2.1.0
2.1.1
2.2.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.1
3.2.0