CVE-2022-25844
angular vulnerable to regular expression denial of service (ReDoS)
Summary
angular vulnerable to regular expression denial of service (ReDoS)
Original description
The description as published by the source.
AngularJS lets users write client-side web applications. The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value.
Note:
- This package has been deprecated and is no longer maintained.
- The vulnerable versions are 1.7.0 and higher.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
npm
angular
[{"type":"SEMVER","events":[{"introduced":"1.7.0"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-25844 angular.js Fixed in: 1.8.3-1+deb12u1~deb11u1
References
- advisory nvd.nist.gov
- package github.com
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web security.netapp.com
- web snyk.io
- web snyk.io
- web snyk.io
- web snyk.io
- web stackblitz.com