7.5
Élevée
CVE-2024-21490 This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0
Description
This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. **Note:** This package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| angular 1.3 | 1.3.0 → dernières | Pas de correctif indiqué |
| org.webjars.bower:angular 1.3 | 1.3.0 → dernières | Pas de correctif indiqué |
| org.webjars.npm:angular 1.3 | 1.3.0 → dernières | Pas de correctif indiqué |
| AngularJS 1.3 | 1.3.0 → dernières | Pas de correctif indiqué |
Autres CVE de angular
Les 6 CVE de angular →
CVE-2023-26116
Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the…
5.3
Moyenne
CVE-2023-26118
Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the …
5.3
Moyenne
CVE-2023-26117
Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the…
5.3
Moyenne
CVE-2022-25869
All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs…
4.2
Moyenne