Description

Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

Remediation

References

https://stackblitz.com/edit/angularjs-vulnerability-inpur-url-validation-redos

https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373046

https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406328

https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406327

https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406326

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K/

Related Vulnerabilities

CVE-2020-19697 Vulnerability in maven package org.webjars.bowergithub.pandao:editor.md

CVE-2020-35202 Vulnerability in maven package org.igniterealtime.openfire.plugins:dbaccess

CVE-2022-24999 Vulnerability in npm package qs

CVE-2021-43862 Vulnerability in npm package jquery.terminal

CVE-2022-0654 Vulnerability in npm package requestretry

Severity

Medium

Classification

CWE-1333 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Tags

Exploit Third Party Advisory Mailing List