CVE-2022-31129

Impact

• using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs
• noticeable slowdown is observed with inputs above 10k characters
• users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks

Patches

The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking.

Workarounds

In general, given the proliferation of ReDoS attacks, it makes sense to limit the length of the user input to something sane, like 200 characters or less. I haven't seen legitimate cases of date-time strings longer than that, so all moment users who do pass a user-originating string to constructor are encouraged to apply such a rudimentary filter, that would help with this but also most future ReDoS vulnerabilities.

References

There is an excellent writeup of the issue here: https://github.com/moment/moment/pull/6015#issuecomment-1152961973=

Details

The issue is rooted in the code that removes legacy comments (stuff inside parenthesis) from strings during rfc2822 parsing. moment("(".repeat(500000)) will take a few minutes to process, which is unacceptable.

Root has patched CVE-2022-31129 in the moment package for Root:npm. Multiple fixed versions available.

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

TuxCare rebuilt moment to address 2 CVEs. Fixed in 2.24.0-tuxcare.1.

TuxCare rebuilt moment to address 2 CVEs. Fixed in 2.22.2-tuxcare.1.

It was discovered that Jupyter Notebook incorrectly handled certain notebooks. An attacker could possibly use this issue of lack of Content Security Policy in Nbconvert to perform cross-site scripting (XSS) attacks on the notebook server. (CVE-2018-19351)

It was discovered that Jupyter Notebook incorrectly handled certain SVG documents. An attacker could possibly use this issue to perform cross-site scripting (XSS) attacks. (CVE-2018-21030)

It was discovered that Jupyter Notebook incorrectly filtered certain URLs on the login page. An attacker could possibly use this issue to perform open-redirect attack. (CVE-2019-10255)

It was discovered that Jupyter Notebook had an incomplete fix for CVE-2019-10255. An attacker could possibly use this issue to perform open-redirect attack using empty netloc. (CVE-2019-10856)

It was discovered that Jupyter Notebook incorrectly handled the inclusion of remote pages on Jupyter server. An attacker could possibly use this issue to perform cross-site script inclusion (XSSI) attacks. (CVE-2019-9644)

It was discovered that Jupyter Notebook incorrectly filtered certain URLs to a notebook. An attacker could possibly use this issue to perform open-redirect attack. (CVE-2020-26215)

It was discovered that Jupyter Notebook server access logs were not protected. An attacker having access to the notebook server could possibly use this issue to get access to steal sensitive information such as auth/cookies. (CVE-2022-24758)

It was discovered that Jupyter Notebook incorrectly configured hidden files on the server. An authenticated attacker could possibly use this issue to see unwanted sensitive hidden files from the server which may result in getting full access to the server. (CVE-2022-29238)

Moment.js: Path traversal in moment.locale (CVE-2022-24785)

moment: inefficient parsing algorithim resulting in DoS (CVE-2022-31129)

Path traversal in moment.locale. (CVE-2022-24785) Inefficient parsing algorithim resulting in DoS. (CVE-2022-31129)

This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues:

Release notes for SUSE Manager:

• Update to SUSE:Manager 4.2.9
  • Notification about SUSE Manager end-of-life has been added
  • CVEs fixed: CVE-2021-43138, CVE-2021-42740, CVE-2022-31129, CVE-2021-41411
  • Bugs mentioned: bsc#1172705, bsc#1187028, bsc#1195455, bsc#1195895, bsc#1196729 bsc#1198168, bsc#1198489, bsc#1198738, bsc#1198903, bsc#1199372 bsc#1199659, bsc#1199913, bsc#1199950, bsc#1200276, bsc#1200296 bsc#1200480, bsc#1200532, bsc#1200573, bsc#1200591, bsc#1200629 bsc#1201142, bsc#1201189, bsc#1201210, bsc#1201220, bsc#1201224 bsc#1201527, bsc#1201606, bsc#1201607, bsc#1201626, bsc#1201753 bsc#1201913, bsc#1201918, bsc#1202142, bsc#1202272, bsc#1202464 bsc#1202728, bsc#1203287, bsc#1203288, bsc#1203449

Release notes for SUSE Manager Proxy:

• Update to SUSE Manager 4.2.9
  • CVEs fixed: CVE-2021-43138, CVE-2021-42740, CVE-2022-31129
  • Bugs mentioned: bsc#1198168, bsc#1198903, bsc#1199659, bsc#1200480, bsc#1200591 bsc#1201142, bsc#1202142, bsc#1202724

This update fixes the following issues:

drools:

• CVE-2021-41411: XML External Entity injection in KieModuleModelImpl.java. (bsc#1200629)

httpcomponents-asyncclient:

• Provide maven metadata needed by other packages to build

image-sync-formula:

• Update to version 0.1.1661440526.b08d95b
  • Add option to sort boot images by version (bsc#1196729)

inter-server-sync:

• Version 0.2.3
  • Compress exported sql data #16631
  • Add gzip dependency to decompress data file during import process

patterns-suse-manager:

• Strictly require OpenJDK 11 (bsc#1202142)

py27-compat-salt:

• Add support for gpgautoimport in zypperpkg module
• Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
• Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
• Unify logic on using multiple requisites and add onfail_all (bsc#1198738)
• Normalize package names once with pkg.installed/removed using yum (bsc#1195895)

salt-netapi-client:

• Declare the LICENSE file as license and not doc
• Adapted for Enterprise Linux 9.
• Version 0.20.0
  • See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.20.0

saltboot-formula:

• Update to version 0.1.1661440526.b08d95b
  • Fallback to local boot if the configured image is not synced
  • improve image url modifications - preparation for ftp/http changes

spacecmd:

• Version 4.2.19-1
  • Process date values in spacecmd api calls (bsc#1198903)
  • Show correct help on calling kickstart_importjson with no arguments
  • Fix tracebacks on spacecmd kickstart_export (bsc#1200591)

spacewalk-admin:

• Version 4.2.12-1
  • Add --help option to mgr-monitoring-ctl

spacewalk-backend:

• Version 4.2.24-1
  • Make reposync use the configured http proxy with mirrorlist (bsc#1198168)
  • Revert proxy listChannels token caching pr#4548
  • cleanup leftovers from removing unused xmlrpc endpoint

spacewalk-certs-tools:

• Version 4.2.18-1
  • traditional stack bootstrap: install product packages (bsc#1201142)

spacewalk-client-tools:

• Version 4.2.20-1
  • Update translation strings

spacewalk-java:

• Version 4.2.41-1
  • Fixed date format on scheduler related messages (bsc#1195455)
  • Support inherited values for kernel options from Cobbler API (bsc#1199913)
  • Add channel availability check for product migration (bsc#1200296)
  • Check if system has all formulas correctly assigned (bsc#1201607)
  • Remove group formula assignments and data on group delete (bsc#1201606)
  • Fix sync for external repositories (bsc#1201753)
  • fix state.apply result parsing in test mode (bsc#1201913)
  • Reduce the length of image channel URL (bsc#1201220)
  • Calculate dependencies between cloned channels of vendor channels (bsc#1201626)
  • fix symlinks pointing to ongres-stringprep
  • Modify parameter type when communicating with the search server (bsc#1187028)
  • Fix initial profile and build host on Image Build page (bsc#1199659)
  • Fix the confirm message on the refresh action by adding a link to pending actions on it (bsc#1172705)
  • require new salt-netapi-client version
  • Clean grub2 reinstall entry in autoyast snippet (bsc#1199950)

spacewalk-search:

• Version 4.2.8-1
  • Add methods to handle session id as String

spacewalk-web:

• Version 4.2.29-1
  • CVE-2021-43138: Obtain privileges via the mapValues() method. (bsc#1200480)
  • CVE-2021-42740: Command injection in the shell-quote package. (bsc#1203287)
  • CVE-2022-31129: Denial-of-Service moment: inefficient parsing algorithm (bsc#1203288)
  • Fix table header layout for unselectable tables
  • Fix initial profile and build host on Image Build page (bsc#1199659)

subscription-matcher:

• Added Guava maximum version requirement.

susemanager:

• Version 4.2.37-1
  • mark new dependencies for python-py optional in bootstrap repo to fix generation for older service packs (bsc#1203449)
• Version 4.2.36-1
  • add missing packages on SLES 15
  • remove…

This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues:

Release notes for SUSE Manager:

• Update to SUSE Manager 4.3.2
  • Containerized proxy and RBS are now fully supported
  • HTTP API is now fully supported
  • Ubuntu 22.04 is now supported as a client
  • Cobbler has been upgraded to version 3.3.3 which also includes building ISOs with UEFI support
  • pip support has been added for the Salt Bundle
  • Prometheus exporter for Apache has been upgraded to 0.10.0
  • CVEs fixed: CVE-2021-41411, CVE-2021-42740, CVE-2021-43138, CVE-2022-0860, CVE-2022-31129
  • Bugs mentioned: bsc#1191857, bsc#1195624, bsc#1196729, bsc#1197027, bsc#1198168 bsc#1198903, bsc#1199726, bsc#1200480, bsc#1200573, bsc#1200629 bsc#1201210, bsc#1201220, bsc#1201260, bsc#1201626, bsc#1201753 bsc#1201788, bsc#1201913, bsc#1201918, bsc#1202271, bsc#1202272 bsc#1202367, bsc#1202455, bsc#1202464, bsc#1202602, bsc#1202728 bsc#1202729, bsc#1202805, bsc#1202899, bsc#1203026, bsc#1203049 bsc#1203056, bsc#1203169, bsc#1203287, bsc#1203288, bsc#1203385 bsc#1203406, bsc#1203422, bsc#1203449, bsc#1203478, bsc#1203484 bsc#1203564, bsc#1203585, bsc#1203611

Release notes for SUSE Manager Proxy:

• Update to SUSE Manager 4.3.2
  • Containerized proxy and RBS are now fully supported
  • CVEs fixed: CVE-2021-42740, CVE-2021-43138, CVE-2022-31129
  • Bugs mentioned: bsc#1198168, bsc#1198903, bsc#1200480, bsc#1201589, bsc#1201788 bsc#1203287, bsc#1203288, bsc#1203585

This update fixes the following issues:

cobbler:

• Fix improper authorization (bsc#1197027, CVE-2022-0860)
• Prevent error when starting up logrotate.service (bsc#1188191)

drools:

• Deserialization of Untrusted Data: unsafe data deserialization in DroolsStreamUtils.java (bsc#1204879, CVE-2022-1415)

grafana-formula:

• Version 0.8.1
  • Fix Uyuni/SUMA dashboard names
• Version 0.8.0
  • Set dashboard names depending on project
  • Update dashboards to use new JSON schema
  • Fix PostgreSQL dashboard queries
  • Migrate deprecated panels to their current replacements
• Version 0.7.1
  • Fix default password field description (bsc#1203698)
  • Do not require default admin and password fields

inter-server-sync:

• Version 0.2.7
  • Do not update pillars table if it does not exists like in 4.2
• Version 0.2.6
  • Export package extra tags for complete debian repo metatdata (bsc#1206375)
  • Replace URLs in OS Images pillars when exporting and importing images
• Version 0.2.5
  • Correct error when importing without debug log level (bsc#1204699)

mgr-osad:

• Version 4.2.9-1
  • Updated logrotate configuration (bsc#1206470)

prometheus-formula:

• Version 0.7.0
  • Switch from basic authentication to TLS certificate client authentication for Blackbox exporter
  • Fix scheme label in clients targets configration
  • Add README.md

py27-compat-salt:

• Ignore extend declarations from excluded SLS files (bsc#1203886)
• Enhance capture of error messages for Zypper calls in zypperpkg module

rhnlib:

• Version 4.2.7-1
  • Don't get stuck at the end of SSL transfers (bsc#1204032)

saltboot-formula:

• Update to version 0.1.1676908681.e90e0b1
  • Add failsafe stop file when salt-minion does not stop (bsc#1208418)
  • Support salt bundle (bsc#1208499)

salt-netapi-client:

• Version 0.21.0
  • See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.21.0
• Add transactional_update module
• Improve logging when creating salt exception

smdba:

• Version 1.7.11
  • fix config update from wal_keep_segments to wal_keep_size for newer postgresql versions (bsc#1204519)

spacecmd:

• Version 4.2.21-1
  • Prevent string api parameters to be parsed as dates if not in ISO-8601 format (bsc#1205759)
  • Add python-dateutil dependency, required to process date values in spacecmd api calls
  • Correctly understand 'ssm' keyword on scap scheduling
  • Fix dict_keys not supporting indexing in systems_setconfigchannelorger

spacewalk-admin:

• Version 4.2.13-1
  • Generate uyuni_roster.conf with salt-secrets-config (bsc#1200096)

spacewalk-backend:

• Version 4.2.26-1
  • Fix reposync error about missing 'content-type' key when syncing certain channels
  • Compute headers as list of two-tuples to be used by url grabber (bsc#1205523)
  • Updated logrotate configuration (bsc#1206470)
  • Add 'octet-stream' to accepted content-types for reposync mirrorlists
  • Exclude invalid mirror urls for reposync (bsc#1203826)
  • do not fetch mirrorlist when a file url is given
  • Keep older module metadata files in database (bsc#1201893)
  • Removed the activation keys report from the debug information

spacewalk-certs-tools:

• Version 4.2.19-1
  • some i18n functions moved to new module which needs to be loaded (bsc#1201142)
  • Generated bootstrap scripts installs all needed Salt 3004 dependencies for Ubuntu 18.04 (bsc#1204517)

spacewalk-client-tools:

• Version 4.2.22-1
  • Update translation strings

spacewalk-java:

• Version 4.2.47-1
  • Use uyuni roster salt module instead of flat roster files (bsc#1200096)
• Version 4.2.46-1
  • Fix registration with proxy and tunnel SSH (bsc#1200096)
• Version 4.2.45-1
  • Add 'none' matcher to CLM AppStream filters (bsc#1206817)
  • Improve logs when sls action chain file is missing
  • Do not forward ssh command if proxy and tunnel are present (bsc#1200096)
  • Fix not being able to delete CLM environment if there are custom child channels that where not built by the environment…

It was discovered that Moment.js incorrectly handled certain input paths. An attacker could possibly use this issue to cause a loss of integrity by changing the correct path to one of their choice. (CVE-2022-24785)

It was discovered that Moment.js incorrectly handled certain input. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-31129)

It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly sanitizing user input when generating templates. An attacker could, through PHP injection, possibly use this issue to execute arbitrary code. (CVE-2022-29221)

It was discovered that Moment.js, that is integrated in the PostfixAdmin code, was using an inefficient parsing algorithm when processing date strings in the RFC 2822 standard. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-31129)

It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly escaping JavaScript code. An attacker could possibly use this issue to conduct cross-site scripting attacks (XSS). (CVE-2023-28447)