Luxon up to 1.38.0/2.5.1/3.2.0 DateTime.fromRFC2822 redos

Summaryinfo

A vulnerability marked as problematic has been reported in Luxon up to 1.38.0/2.5.1/3.2.0. Impacted is the function DateTime.fromRFC2822. Performing a manipulation results in redos. This vulnerability is identified as CVE-2023-22467. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Luxon up to 1.38.0/2.5.1/3.2.0. This affects the function DateTime.fromRFC2822. The manipulation with an unknown input leads to a redos vulnerability. CWE is classifying the issue as CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. This is going to have an impact on availability. The summary by CVE is:

Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.

The weakness was released 01/05/2023 as GHSA-3xq5-wjfh-ppjc. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2023-22467 since 12/29/2022. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1449.003 according to MITRE ATT&CK.

Upgrading to version 1.38.1, 2.5.2 or 3.2.1 eliminates this vulnerability. Applying the patch 5ab3bf64a10da929a437629cdb2f059bb83212bf is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Luxon

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38.0
• 2.5.0
• 2.5.1
• 3.0
• 3.1
• 3.2.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion