New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

⬆️ Update dependency luxon to v3.2.1 [SECURITY] #196

Open

renovate wants to merge 1 commit into master from renovate/npm-luxon-vulnerability

Contributor

renovate bot commented Jan 9, 2023 •

edited

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
luxon	`3.0.1` -> `3.2.1`

GitHub Vulnerability Alerts

CVE-2023-22467

Impact

Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.

This is the same bug as Moment's GHSA-wc69-rhjr-hc9g

Workarounds

Limit the length of the input.

References

There is an excellent writeup of the same issue in Moment: https://github.com/moment/moment/pull/6015#issuecomment-1152961973

Details

DateTime.fromRFC2822("(".repeat(500000)) takes a couple minutes to complete.

Release Notes

moment/luxon (luxon)

`v3.2.1`

Fix for RFC-2822 regex vulnerability
Better handling of BCP tags with -x- extensions

`v3.2.0`

Allow timeZone to be specified as an intl option
Fix for diff's handling of end-of-month when crossing leap years (#1340)
Add Interval.toLocaleString() (#1320)

`v3.1.1`

Add Settings.twoDigitCutoffYear

`v3.1.0`

Add Duration.rescale

`v3.0.4`

Fix quarters in diffs (#1279)
Export package.json in package (#1239)

`v3.0.3`

`v3.0.2`

Lots of doc changes
Added DateTime.expandFormat
Added support for custom conversion matrices in Durations

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.


          ⬆️ Update dependency luxon to v3.2.1 [SECURITY]

ec77c05

sonarcloud bot commented Jan 9, 2023

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment