CVE-2016-4055 Regular Expression Denial of Service in moment
MediumCVSS 6.5
EPSS 9.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm moment(npm) | < 2.11.2 | 2.11.2 |
| debian/node-moment(Debian:12) | < 2.13.0+ds-1 | 2.13.0+ds-1 |
| debian/node-moment(Debian:13) | < 2.13.0+ds-1 | 2.13.0+ds-1 |
| debian/node-moment(Debian:14) | < 2.13.0+ds-1 | 2.13.0+ds-1 |
| momentjs moment | < 2.11.2 | 2.11.2 |
| tenable Nessus | <= 8.2.3 | No fix listed |
| oracle primavera unifier | >= 16.0, <= 18.8.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com
- www.npmjs.com
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- www.tenable.com patch third-party-advisory
- [oss-security] 20160420 various vulnerabilities in Node.js packages mailing-list third-party-advisory
- www.oracle.com patch third-party-advisory
- 95849 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2016-4055 vendor-advisory
- [flink-dev] 20190811 Apache flink 1.7.2 security issues mailing-list
- [flink-user] 20190813 Apache flink 1.7.2 security issues mailing-list
- [flink-user] 20190813 Re: Apache flink 1.7.2 security issues mailing-list
- [flink-user] 20190811 Apache flink 1.7.2 security issues mailing-list
- nodesecurity.io broken-link exploit vendor-advisory