mend-bolt-for-github[bot]
commented
1 year ago :heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
CVE-2023-22467 - High Severity Vulnerability
Immutable date wrapper
Library home page: https://registry.npmjs.org/luxon/-/luxon-3.0.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/luxon/package.json
Dependency Hierarchy: - bull-4.8.5.tgz (Root Library) - cron-parser-4.6.0.tgz - :x: **luxon-3.0.1.tgz** (Vulnerable Library)
Found in HEAD commit: 58456d8a5755e9aff1d0e247b0796fb0e6a0c0f2
Found in base branch: master
Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.
Publish Date: 2023-01-04
URL: CVE-2023-22467
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/moment/luxon/security/advisories/GHSA-3xq5-wjfh-ppjc
Release Date: 2023-01-04
Fix Resolution (luxon): 3.2.1
Direct dependency fix Resolution (bull): 4.9.0
Step up your Open Source Security Game with Mend here