Path Traversal: 'dir/../../filename' in moment.locale
概要
Path Traversal: 'dir/../../filename' in moment.locale
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Impact
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale.
Patches
This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).
Workarounds
Sanitize user-provided locale name before passing it to moment.js.
References
Are there any links users can visit to find out more?
For more information
If you have any questions or comments about this advisory:
- Open an issue in moment repo
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2022-24785 node-moment 修正版: 2.29.1+ds-2+deb11u1
参照URL
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web security.netapp.com
- web security.netapp.com
- web tenable.com