Search for packages
| purl | pkg:rpm/redhat/servicemesh-prometheus@2.23.0-9?arch=el8 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-dsm8-ck8e-wfdh
Aliases: CVE-2022-24675 |
Multiple vulnerabilities have been found in Go, the worst of which could result in remote code execution. | There are no reported fixed by versions. |
|
VCID-k4dy-pv3f-4qas
Aliases: CVE-2022-30629 |
Multiple vulnerabilities have been found in Go, the worst of which could result in remote code execution. | There are no reported fixed by versions. |
|
VCID-kexn-gjxj-uudm
Aliases: CVE-2022-24785 GHSA-8hfj-j24r-96c4 |
Path Traversal: 'dir/../../filename' in moment.locale This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg `fr` is directly used to switch moment locale. | There are no reported fixed by versions. |
|
VCID-mnxk-x51q-wkfp
Aliases: CVE-2022-29526 GHSA-p782-xgp4-8hr8 |
Multiple vulnerabilities have been found in Go, the worst of which could result in remote code execution. | There are no reported fixed by versions. |
|
VCID-ptd4-8f7f-hyg6
Aliases: CVE-2022-31129 GHSA-wc69-rhjr-hc9g |
Moment.js vulnerable to Inefficient Regular Expression Complexity ### Impact * using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs * noticeable slowdown is observed with inputs above 10k characters * users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks ### Patches The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. ### Workarounds In general, given the proliferation of ReDoS attacks, it makes sense to limit the length of the user input to something sane, like 200 characters or less. I haven't seen legitimate cases of date-time strings longer than that, so all moment users who do pass a user-originating string to constructor are encouraged to apply such a rudimentary filter, that would help with this but also most future ReDoS vulnerabilities. ### References There is an excellent writeup of the issue here: https://github.com/moment/moment/pull/6015#issuecomment-1152961973= ### Details The issue is rooted in the code that removes legacy comments (stuff inside parenthesis) from strings during rfc2822 parsing. `moment("(".repeat(500000))` will take a few minutes to process, which is unacceptable. | There are no reported fixed by versions. |
|
VCID-yzsx-6acm-kkb6
Aliases: CVE-2022-28327 |
Multiple vulnerabilities have been found in Go, the worst of which could result in remote code execution. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||