Luxon Inefficient Regular Expression Complexity vulnerability

Description

Luxon’s DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.

This is the same bug as Moment’s https://github.

Recommendation

Update the luxon package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.0.0, < 1.28.1

  >= 3.0.0, < 3.2.1

  >= 2.0.0, < 2.5.2**

• Patched version(s): **1.28.1

  3.2.1

  2.5.2**

References

• GHSA-3xq5-wjfh-ppjc
• lists.fedoraproject.org
• CVE-2023-22467
• CWE-1333
• CAPEC-310
• OWASP 2021-A6