Skip to content
OpenAdvisories
High · 7.5 CVE-2017-18214 EUVD-2018-0169GHSA-446m-mv8f-q348

Regular Expression Denial of Service in moment

Published Mar 4, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Package: moment Package: node-moment Package: node-moment Package: ntopng Package: reaper Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: npm Ecosystem: Ubuntu

Description

The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 node-moment 2.19.3+ds-1 —
Debian 13 node-moment 2.19.3+ds-1 —
Debian 12 node-moment 2.19.3+ds-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS node-moment 2.11.0+ds-1ubuntu0.1~esm1 USN-4786-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-apache-sshd 2.9.2-1.redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-elytron-web +1 1.9.3-1.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-hibernate-search +5 5.10.13-3.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.5.10-1.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-jackson-core +10 2.12.7-1.redhat_00003.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-javaee-security-soteria +1 1.0.1-3.redhat_00003.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.49-1.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-jboss-jsf-api_2.3_spec 3.0.0-6.SP07_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-jboss-jsp-api_2.3_spec 2.0.0-3.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.27-1.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-jboss-server-migration +2 1.10.0-24.Final_redhat_00023.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-jettison 1.5.2-1.redhat_00002.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-wildfly +4 7.4.9-4.GA_redhat_00003.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.15.16-1.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-woodstox-core 6.4.0-1.redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 ntopng 5.2.1-4 —
Azure Linux 2 (CBL-Mariner) reaper 3.1.1-10 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm moment < 2.19.3 2.19.3 GHSA-446m-mv8f-q348

Advisories 6

References