5
CVSSv2

CVE-2022-31129

Published: 06/07/2022 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

momentjs moment

fedoraproject fedora 35

fedoraproject fedora 36

fedoraproject fedora 37

debian debian linux 10.0

Vendor Advisories

Debian Bug report logs - #1014845 node-moment: CVE-2022-31129 Package: src:node-moment; Maintainer for src:node-moment is Debian Javascript Maintainers <pkg-javascript-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 13 Jul 2022 06:42:01 UTC Severity: grave Tags: securi ...
Several security issues were fixed in Momentjs ...
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates Affected versions of moment were found to use an inefficient parsing algorithm Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs Users m ...
Synopsis Moderate: Red Hat Kiali for OpenShift Service Mesh 22 security update Type/Severity Security Advisory: Moderate Topic Red Hat Kiali for OpenShift Service Mesh 22 ContainersRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a de ...
Synopsis Moderate: Red Hat OpenShift Service Mesh 2011 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat OpenShift Service Mesh 2011Red Hat Product Security has rat ...
Synopsis Important: Red Hat Gluster Storage web-admin-build security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat Gluster Storage 35 for RHEL 7Red Hat Product Security ha ...
Synopsis Important: RHV RHEL Host (ovirt-host) [ovirt-452] security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Updated host packages that fix several bugs and add various enhancements are now availableRed H ...
Synopsis Moderate: Red Hat Advanced Cluster Management 248 security fixes and container updates Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 248 GeneralAvailability release images, which fix security issuesRed Hat Product Security has rated this update as having a security impactof Mo ...
概述 Moderate: Red Hat Ceph Storage 61 security and bug fix update 类型/严重性 Security Advisory: Moderate Red Hat Insights 补丁分析 识别并修复受此公告影响的系统。 查看受影响的系统 标题 New packages for Red Hat Ceph Storage 61 are now available on Red Hat Enterprise LinuxRed Hat Product Securit ...
Synopsis Moderate: Red Hat Kiali for OpenShift Service Mesh 20 security update Type/Severity Security Advisory: Moderate Topic An update for openshift-istio-kiali-rhel8-container is now available for OpenShift Service Mesh 20Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scori ...
Synopsis Moderate: Red Hat Kiali for OpenShift Service Mesh 21 security update Type/Severity Security Advisory: Moderate Topic Red Hat Kiali for OpenShift Service Mesh 21 ContainersRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a de ...
Synopsis Critical: Red Hat Advanced Cluster Management 252 security fixes and bug fixes Type/Severity Security Advisory: Critical Topic Red Hat Advanced Cluster Management for Kubernetes 252 GeneralAvailability release images, which fix security issues and bugsRed Hat Product Security has rated this update as having a security impactof C ...
Synopsis Moderate: Multicluster Engine for Kubernetes 21 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Multicluster Engine v21Red Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, ...
Synopsis Moderate: Red Hat OpenShift Service Mesh 215 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Service Mesh 215Red Hat Product Security has rated this update as having a securit ...
Synopsis Moderate: Red Hat Advanced Cluster Management 260 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 260 GeneralAvailability release images, which fix security issues and bugsRed Hat Product Security has rated this update as having a security impactof ...
Synopsis Important: Service Registry (container images) release and security update [230GA] Type/Severity Security Advisory: Important Topic An update to the images for Red Hat Integration Service Registry is now available from the Red Hat Container Catalog The purpose of this text-only errata is to inform you about the security issues fi ...
Synopsis Moderate: Red Hat Advanced Cluster Management 2312 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 2312 GeneralAvailability release images, which provide security updates and bug fixesRed Hat Product Security has rated this update as having a secur ...
Synopsis Important: Red Hat Single Sign-On 762 for OpenShift image security and enhancement update Type/Severity Security Advisory: Important Topic A new image is available for Red Hat Single Sign-On 762, running on RedHat OpenShift Container Platform from the release of 311 up to the releaseof 4120Red Hat Product Security has rated t ...
Synopsis Critical: Multicluster Engine for Kubernetes 202 security and bug fixes Type/Severity Security Advisory: Critical Topic Multicluster Engine for Kubernetes 202 General Availability release images, which fix bugs and update container imagesRed Hat Product Security has rated this update as having a security impactof Critical A Com ...
Synopsis Important: Red Hat OpenShift Data Foundation 4110 security, enhancement, & bugfix update Type/Severity Security Advisory: Important Topic Updated images that include numerous enhancements, security, and bug fixes are now available for Red Hat OpenShift Data Foundation 4110 on Red Hat Enterprise Linux 8Red Hat Product Securit ...
Synopsis Important: Red Hat Process Automation Manager 7131 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Process Automation ManagerRed Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) base score, which gives ...
Synopsis Important: Red Hat Fuse 7111 release and security update Type/Severity Security Advisory: Important Topic A minor version update (from 711 to 7111) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security has rated this updat ...
Synopsis Important: RHV Manager (ovirt-engine) [ovirt-452] bug fix and security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Updated ovirt-engine packages that fix several bugs and add various enhancements are ...
概述 Important: Red Hat Single Sign-On 762 security update on RHEL 8 类型/严重性 Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems 标题 New Red Hat Single Sign-On 762 packages are now available for Red Hat Enterprise Linux 8Red H ...
Synopsis Important: Red Hat Single Sign-On 762 security update on RHEL 7 Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic New Red Hat Single Sign-On 762 packages are now available for Red Hat Enterprise Linux 7Red Hat ...
Synopsis Important: Red Hat Single Sign-On 762 security update on RHEL 9 Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic New Red Hat Single Sign-On 762 packages are now available for Red Hat Enterprise Linux 9Red Hat ...
Synopsis Important: Red Hat Single Sign-On 762 security update Type/Severity Security Advisory: Important Topic A security update is now available for Red Hat Single Sign-On 76 from the Customer PortalRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base ...
Synopsis Important: Red Hat OpenShift Data Foundation 4130 security and bug fix update Type/Severity Security Advisory: Important Topic Updated images that include numerous enhancements, security, and bug fixes are now available in Red Hat Container Registry for Red Hat OpenShift Data Foundation 4130 on Red Hat Enterprise Linux 9Red Hat ...
Synopsis Moderate: RHOSDT 260 operator/operand containers Security Update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat Openshift distributed tracing 260Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, w ...
Synopsis Critical: Red Hat Advanced Cluster Management 246 security update and bug fixes Type/Severity Security Advisory: Critical Topic Red Hat Advanced Cluster Management for Kubernetes 246 GeneralAvailability release images, which fix bugs and update container imagesRed Hat Product Security has rated this update as having a security i ...
Synopsis Moderate: Red Hat Advanced Cluster Management 262 security update and bug fixes Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 262 GeneralAvailability release images, which fix bugs and update container imagesRed Hat Product Security has rated this update as having a security i ...