search

TryGhost / migrate

MIT License
39 stars 18 forks source link

Regular Expression Denial of Service (ReDoS) vulnerability in moment #1030

Open camgrimsec opened 5 months ago

camgrimsec commented 5 months ago

Introduced through ghost-ignition@4.6.3 Fixed in moment@2.29.4

Exploit maturity
Proof of Concept

Detailed paths

Introduced through: @tryghost/mg-substack-members-csv@0.4.18 › ghost-ignition@4.6.3 › moment@2.27.0
Fix: No remediation path available.

Security information Factors contributing to the scoring:

Snyk: [CVSS 7.5](https://security.snyk.io/vuln/SNYK-JS-MOMENT-2944238) - High Severity
NVD: [CVSS 7.5](https://nvd.nist.gov/vuln/detail/CVE-2022-31129) - High Severity

Why are the scores different? Learn how Snyk evaluates vulnerability scores Overview

moment is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the preprocessRFC2822() function in from-string.js, when processing a very long crafted string (over 10k characters).