Headline
CVE-2023-22467: [bugfix] Fix redos in preprocessRFC2822 regex by vovikhangcdv · Pull Request #6015 · moment/moment
Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon’s `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.
Conversation
change the direct matching regex to a local backtracking regex to support all characters in the token comment
update regex to avoid matching more open brackets from @ichernev suggestion
ichernev added a commit that referenced this pull request
Jul 6, 2022
ichernev pushed a commit that referenced this pull request
Jul 6, 2022
* fix ReDoS in preprocessRFC2822 regex
Fixes: [#2936](#6012)
Disallow nested rfc2822 comments to prevent quadratic regex execution time (i.e each open bracket is considered at most twice).
eexit mentioned this pull request
Jul 12, 2022
jhuckaby added a commit to jhuckaby/Cronicle that referenced this pull request
Jul 29, 2022
michaeljmarshall pushed a commit to datastax/pulsar-admin-console that referenced this pull request
Aug 30, 2022
Related news
Red Hat Advanced Cluster Management for Kubernetes 2.7.0 General Availability release images, which provide security updates and fix bugs. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3517: A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service. * CVE-2022-30629: A flaw was found in the crypto/tls golang pa...
# Impact Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This is the same bug as Moment's https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g # Workarounds Limit the length of the input. # References There is an excellent writeup of the same issue in Moment: https://github.com/moment/moment/pull/6015#issuecomment-1152961973 # Details `DateTime.fromRFC2822("(".repeat(500000))` takes a couple minutes to complete.