GHSA-3xq5-wjfh-ppjc
Suggest an improvement- Source
- https://github.com/advisories/GHSA-3xq5-wjfh-ppjc
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-3xq5-wjfh-ppjc/GHSA-3xq5-wjfh-ppjc.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-3xq5-wjfh-ppjc
- Aliases
- Published
- 2023-01-09T14:10:49Z
- Modified
- 2024-02-12T06:30:33Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Luxon Inefficient Regular Expression Complexity vulnerability
- Details
-
Impact
Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.
This is the same bug as Moment's https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g
Workarounds
Limit the length of the input.
References
There is an excellent writeup of the same issue in Moment: https://github.com/moment/moment/pull/6015#issuecomment-1152961973
Details
DateTime.fromRFC2822("(".repeat(500000))takes a couple minutes to complete. - Database specific
{ "nvd_published_at": "2023-01-04T22:15:00Z", "cwe_ids": [ "CWE-1333" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-01-09T14:10:49Z" }- References
-
- https://github.com/moment/luxon/security/advisories/GHSA-3xq5-wjfh-ppjc
- https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g
- https://nvd.nist.gov/vuln/detail/CVE-2023-22467
- https://github.com/moment/moment/pull/6015#issuecomment-1152961973
- https://github.com/moment/luxon/commit/5ab3bf64a10da929a437629cdb2f059bb83212bf
- https://github.com/moment/luxon
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/44I3WAJKYXDLOVYRGMHAUXMIV4SPFXDZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LIVOASKBQH7FEUI5RWM3SOHR6VK7ZZR
Affected packages
npm / luxon
Package
- Name
- luxon
- View open source insights on deps.dev
- Purl
- pkg:npm/luxon
npm / luxon
Package
- Name
- luxon
- View open source insights on deps.dev
- Purl
- pkg:npm/luxon
npm / luxon
Package
- Name
- luxon
- View open source insights on deps.dev
- Purl
- pkg:npm/luxon