CVE-2016-4055
Fixed in a distro release EPSS 10%
The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."
Products: momentjs moment, tenable nessus, oracle primavera_unifier
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | moment | 2.11.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | node-moment | 2.13.0+ds-1 |
| Debian 13 | node-moment | 2.13.0+ds-1 |
| Debian 14 | node-moment | 2.13.0+ds-1 |
| Ubuntu Pro 16.04 LTS | node-moment | 2.11.0+ds-1ubuntu0.1~esm1 |