Open bchartier opened 5 years ago
Thanks, for reporting, it looks like 3.4.x and master are both using moment 2.18.1 cf. https://github.com/geonetwork/core-geonetwork/blob/3.4.x/web-ui/src/main/resources/catalog/lib/moment+langs.min.js#L82. Which version are you using ?
Hum 3.2.2. Sorry. So, this vulnerability has been fixed as I can see in your answer. Sorry again for this outdated alert.
You can safely cherry-pick the commit if you need it applied to 3.2.2 https://github.com/geonetwork/core-geonetwork/commit/313c7e2a452e908c1ff283c1b3e8e02ea7d2aa73#diff-56c156a44c44136483e50386ea7842aa
Thank you very much.
I closed this issue too quickly. An other vulnerabilty (less severe) exists with versions of Moment less than 2.19.3: see https://github.com/moment/moment/issues/4163 and https://nodesecurity.io/advisories/532
Sorry, I should have noticed this at the same time.
Update done for 3.6.0.
Thank you
We have been informed of a severe regular expression Denial of Service (ReDoS) vulnerabilty caused by the use of an outdated version of moment.js by GeoNetwork: