GHSA-f523-2f5j-gfcg

    Dashboard / Vulnerabilities / GHSA-f523-2f5j-gfcg

    GHSA-f523-2f5j-gfcg

    Published: 29 Aug 2018Last Modified: 8 Nov 2023

    Summary: Regular Expression Denial of Service in timespan

    Details: Affected versions of `timespan` are vulnerable to a regular expression denial of service when parsing dates. The amplification for this vulnerability is significant, with 50,000 characters resulting in the event loop being blocked for around 10 seconds. ## Recommendation No direct patch is available for this vulnerability. Currently, the best available solution is to use a functionally equivalent alternative package. It is also sufficient to ensure that user input is not being passed into `timespan`, or that the maximum length of such user input is drastically reduced. Limiting the input length to 150 characters should be sufficient in most cases.

    References: https://nvd.nist.gov/vuln/detail/CVE-2017-16115, https://github.com/indexzero/TimeSpan.js/issues/10, https://github.com/advisories/GHSA-f523-2f5j-gfcg, https://www.npmjs.com/advisories/533

    Affected packages

    Package

    Name: timespan

    Purl: pkg:npm/timespan

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High