CVE-2023-26116

Description

Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

References

https://stackblitz.com/edit/angularjs-vulnerability-angular-copy-redos

https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373044

https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406321

https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406322

https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406320

https://lists.fedoraproject.org/archives/list/[email protected]/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K/

https://lists.fedoraproject.org/archives/list/[email protected]/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ/

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3