Luxon Inefficient Regular Expression Complexity vulnerability
Package
Affected versions
>= 2.0.0, < 2.5.2
>= 3.0.0, < 3.2.1
>= 1.0.0, < 1.28.1
Patched versions
2.5.2
3.2.1
1.28.1
Description
Published by the National Vulnerability Database
Jan 4, 2023
Published to the GitHub Advisory Database
Jan 9, 2023
Reviewed
Jan 9, 2023
Last updated
Feb 2, 2023
Credits
-
skrtheboss Analyst
-
remi-san Analyst
-
makkes Analyst
-
canderson-activatecare Analyst
-
rpastro Analyst
-
cmp831 Analyst
Impact
Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.
This is the same bug as Moment's GHSA-wc69-rhjr-hc9g
Workarounds
Limit the length of the input.
References
There is an excellent writeup of the same issue in Moment: moment/moment#6015 (comment)
Details
DateTime.fromRFC2822("(".repeat(500000))takes a couple minutes to complete.References