Moment JS vulnerability for version < 2.29.4

Camunda 7 Topics Discussion & Questions
,
1

Hello!
It seems like the Webapp is running a vulnerable version of Moment.js. The latest master branch for camunda-bpm-platform, as well as the latest alpha version of 7.18, is using version 2.29.3. The vulnerable versions range from >= 2.18.0, < 2.29.4.

https://nvd.nist.gov/vuln/detail/CVE-2022-31129

I couldn’t find any ongoing tasks in the CAM Jira space or any related issues in this forum so I’m just wondering if you’re aware of this vulnerability and if there are any plans on upgrading the library?

1 Like
2

After 6+ Month the vulnerability is still reported with camunda-bpm-spring-boot-starter 7.18.0 by owasp dependency check.

From Camunda side there is just a mention in security notes here: Security Notices 76 | docs.camunda.org but no reflection in the spring-boot-starter. What ist the status here?

3

Hi,

We have assessed this vulnerability to not affect the Camunda 7 webapps. We have updated moment-js to a newer version in 7.19.0-alpha1 and will release that with 7.19.0 in April (via Update moment-js in the webapps · Issue #2800 · camunda/camunda-bpm-platform · GitHub).

Cheers,
Thorben

2 Likes
4

Thanks for the update, Thorben!

5