PatchTheCVEdate vulnerabilities and fixes
Recent CVEs affecting date, with upgrade or downgrade steps. 3 tracked.
date has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2022-01-01. Highest priority: CVE-2021-41817 (score 64/100).
- CVE-2021-41817 HIGH 7.5 UPGRADE UPGRADE Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a lo
- CVE-2014-5169 LOW 3.5 UPGRADE Cross-site scripting (XSS) vulnerability in the Date module before 7.x-2.8 for Drupal allows remote authentica
- CVE-2012-1626 MEDIUM 6.0 DOWNGRADE SQL injection vulnerability in the conversion form for Events in the Date module 6.x-2.x before 6.x-2.8 for Dr
FAQ
How do I fix date vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is date being exploited right now?
None of the tracked date CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which date CVE should I patch first?
CVE-2021-41817 currently ranks highest (64/100): Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a lo.