moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.
History

Sun, 08 Sep 2024 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat multicluster Engine
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8
cpe:/a:redhat:acm:2.6::el8
cpe:/a:redhat:multicluster_engine:2.0::el8
cpe:/a:redhat:multicluster_engine:2.1::el8
Vendors & Products Redhat multicluster Engine

Mon, 19 Aug 2024 22:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8
cpe:/a:redhat:acm:2.6::el8
cpe:/a:redhat:multicluster_engine:2.0::el8
cpe:/a:redhat:multicluster_engine:2.1::el8
Vendors & Products Redhat multicluster Engine

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2022-07-06T00:00:00

Updated: 2024-08-03T07:11:39.222Z

Reserved: 2022-05-18T00:00:00

Link: CVE-2022-31129

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-07-06T18:15:19.570

Modified: 2023-11-07T03:47:32.993

Link: CVE-2022-31129

cve-icon Redhat

Severity : Important

Publid Date: 2022-07-06T00:00:00Z

Links: CVE-2022-31129 - Bugzilla