node-moment: CVE-2022-24785: path traversal vulnerability

Debian Bug report logs - #1009327
node-moment: CVE-2022-24785: path traversal vulnerability

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: node-moment: CVE-2022-24785: path traversal vulnerability

Date: Mon, 11 Apr 2022 21:17:39 +0200

Source: node-moment
Version: 2.29.1+ds-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 2.29.1+ds-2
Control: found -1 2.24.0+ds-1

Hi,

The following vulnerability was published for node-moment.

CVE-2022-24785[0]:
| Moment.js is a JavaScript date library for parsing, validating,
| manipulating, and formatting dates. A path traversal vulnerability
| impacts npm (server) users of Moment.js between versions 1.0.1 and
| 2.29.1, especially if a user-provided locale string is directly used
| to switch moment locale. This problem is patched in 2.29.2, and the
| patch can be applied to all affected versions. As a workaround,
| sanitize the user-provided locale name before passing it to Moment.js.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-24785
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24785
[1] https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4
[2] https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5

Regards,
Salvatore

Message #12 received at 1009327-submitter@bugs.debian.org (full text, mbox, reply):

From: Yadd <noreply@salsa.debian.org>

To: 1009327-submitter@bugs.debian.org

Subject: Bug#1009327 marked as pending in node-moment

Date: Tue, 12 Apr 2022 04:35:50 +0000

Control: tag -1 pending

Hello,

Bug #1009327 in node-moment reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-moment/-/commit/04ccb83d1541c76cef8b93e2369c16a6dfe8e852

------------------------------------------------------------------------
Avoid loading path-looking locales from fs

Closes: #1009327, CVE-2022-24785
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1009327

Message #21 received at 1009327-done@bugs.debian.org (full text, mbox, reply):

From: Yadd <yadd@debian.org>

To: 1009327-done@bugs.debian.org

Subject: Fwd: node-moment_2.29.2+ds-1_sourceonly.changes ACCEPTED into unstable

Date: Tue, 12 Apr 2022 06:40:32 +0200

Control: fixed -1 2.29.2+ds-1

-------- Forwarded Message --------
Subject: node-moment_2.29.2+ds-1_sourceonly.changes ACCEPTED into unstable
Date: Tue, 12 Apr 2022 04:33:48 +0000
From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>
To: Debian Javascript Maintainers
<pkg-javascript-devel@lists.alioth.debian.org>, Yadd <yadd@debian.org>



Accepted:

Format: 1.8
Date: Tue, 12 Apr 2022 06:22:35 +0200
Source: node-moment
Architecture: source
Version: 2.29.2+ds-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers
<pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Yadd <yadd@debian.org>
Changes:
 node-moment (2.29.2+ds-1) unstable; urgency=medium
 .
   * Team upload
   * Fix filenamemangle
   * New upstream version 2.29.2 (Closes: CVE-2022-24785)
Checksums-Sha1:  91cd77b80561b2bcedfa7eb6ee6c4dd7577fe659 2100
node-moment_2.29.2+ds-1.dsc
 4f59674a386021dd2be387fe179595b68c6e1fde 558656
node-moment_2.29.2+ds.orig.tar.xz
 5e1d8368bd160b7b3c18bdc3d0e6e72d33c69355 3896
node-moment_2.29.2+ds-1.debian.tar.xz
Checksums-Sha256:
42efc25d98f7206e582076e095fd5594460fbc904315b6fa8f030240bab50898 2100
node-moment_2.29.2+ds-1.dsc
 7e8f59059028d8fae310f9d722a5d0b702eaa15186860a888c17c780fb25f06e 558656
node-moment_2.29.2+ds.orig.tar.xz
 1d6c092251821c1a3eb702d6336b7fc6082891b7c7d7cd632cdf085594d45d94 3896
node-moment_2.29.2+ds-1.debian.tar.xz
Files:  1d591fc2510e01b115e742bb1c9543b4 2100 javascript optional
node-moment_2.29.2+ds-1.dsc
 4b1f8dbabcfdb46838fd2f0043e5108c 558656 javascript optional
node-moment_2.29.2+ds.orig.tar.xz
 7f0ec359a7fe34f4eebbca07582131d9 3896 javascript optional
node-moment_2.29.2+ds-1.debian.tar.xz



Thank you for your contribution to Debian.

Send a report that this bug log contains spam.