Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the
    2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic
    (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above
    10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.
    This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for
    this issue. As a workaround, limit the length of the input. (CVE-2023-22467)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-1eb20f8ec3 advisory.

    Update to the latest stable version:

    Features
    --------

    * Implement a new plugin manager from scratch to replace Yapsy,        which does not work on Python 3.12 due to Python 3.12 carelessly        removing parts of the standard library (Issue #3719)
    * Support for Discourse as comment system (Issue #3689)

    Bugfixes
    --------

    * Fix loading of templates from plugins with ``__init__.py`` files        (Issue #3725)
    * Fix margins of paragraphs at the end of sections (Issue #3704)
    * Ignore ``.DS_Store`` files in listing indexes (Issue #3698)
    * Fix baguetteBox.js invoking in the base theme (Issue #3687)
    * Fix development (preview) server ``nikola auto``        for non-root SITE_URL, in particular when URL_TYPE is full_path.
       (Issue #3715)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-262ad83644 advisory.

    Update to the latest stable version:

    Features
    --------

    * Implement a new plugin manager from scratch to replace Yapsy,        which does not work on Python 3.12 due to Python 3.12 carelessly        removing parts of the standard library (Issue #3719)
    * Support for Discourse as comment system (Issue #3689)

    Bugfixes
    --------

    * Fix loading of templates from plugins with ``__init__.py`` files        (Issue #3725)
    * Fix margins of paragraphs at the end of sections (Issue #3704)
    * Ignore ``.DS_Store`` files in listing indexes (Issue #3698)
    * Fix baguetteBox.js invoking in the base theme (Issue #3687)
    * Fix development (preview) server ``nikola auto``        for non-root SITE_URL, in particular when URL_TYPE is full_path.
       (Issue #3715)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
409794	SCA: security update for luxon (GHSA-3xq5-wjfh-ppjc)	Tenable Cloud Security	SCA Checks	high
409794	SCA: security update for luxon (GHSA-3xq5-wjfh-ppjc)	Tenable Self-Hosted Container Security	SCA Checks	high
190395	Fedora 38 : python-nikola (2024-1eb20f8ec3)	Nessus	Fedora Local Security Checks	high
190392	Fedora 39 : python-nikola (2024-262ad83644)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2023-22467

high

Tenable Plugins

high

high

high

high