CVE-2016-4055
Summary
| CVE | CVE-2016-4055 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-01-23 21:59:00 UTC |
| Updated | 2023-11-07 02:32:00 UTC |
| Description | The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)." |
Risk And Classification
Problem Types: CWE-400
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Momentjs | Moment | All | All | All | All |
| Application | Moment Project | Moment | All | All | All | All |
| Application | Oracle | Primavera Unifier | All | All | All | All |
| Application | Tenable | Nessus | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| CPU July 2018 | CONFIRM | www.oracle.com | Patch, Third Party Advisory |
| oss-security - various vulnerabilities in Node.js packages | MLIST | www.openwall.com | Mailing List, Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| [R1] Nessus 8.3.0 Fixes Multiple Third-party Vulnerabilities - Security Advisory | Tenable® | CONFIRM | www.tenable.com | Patch, Third Party Advisory |
| Node Security Platform | Advisory | CONFIRM | nodesecurity.io | Exploit, Vendor Advisory |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Moment.js CVE-2016-4055 Remote Denial of Service Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 730435 Update TITLE manually (JRASERVER-73244)
- 730444 Atlassian Jira Server and Data Center Regular Expression Denial of Service (ReDoS) Vulnerability (JRASERVER-73244)
- 981210 Nodejs (npm) Security Update for moment (GHSA-87vv-r9j6-g5qv)
- 983493 Nodejs (npm) Security Update for moment (GHSA-hxf5-mg84-pj4m)