UBUNTU-CVE-2022-31129

    Dashboard / Vulnerabilities / UBUNTU-CVE-2022-31129

    UBUNTU-CVE-2022-31129

    Published: 6 Jul 2022Last Modified: 2 Jul 2026
    Upstream:
    CVE-2022-31129

    Summary:

    Details: moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

    References: https://ubuntu.com/security/CVE-2022-31129, https://github.com/moment/moment/pull/6015#issuecomment-1152961973, https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g, https://ubuntu.com/security/notices/USN-5559-1, https://ubuntu.com/security/notices/USN-6550-1, https://www.cve.org/CVERecord?id=CVE-2022-31129

    Affected packages

    Package

    Name: gnucash

    Purl: pkg:deb/ubuntu/gnucash?arch=source&distro=xenial

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1:2.6.6-2ubuntu2
    1:2.6.9-1ubuntu1
    1:2.6.12-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2022-31129 | CVE-DB