Summary
It was discovered that Moment.js incorrectly handled certain input paths. An
attacker could possibly use this issue to cause a loss of integrity by
changing the correct path to one of their choice. (CVE-2022-24785)
It was discovered that Moment.js incorrectly handled certain input. An attacker
could possibly use this issue to cause a denial of service. (CVE-2022-31129)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | node-moment | 2.20.1+ds-1ubuntu0.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | node-moment | 2.24.0+ds-2ubuntu0.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | node-moment | 2.29.1+ds-3ubuntu0.2 |
Vulnerabilities 2
-
High 7.5
Path Traversal in Moment.js
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is direct…
-
High 7.5
Inefficient Regular Expression Complexity in moment
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 par…