PT-2023-9165 · Angular+3 · Angular+3
George Kalpakas
·
Publicado
2023-11-28
·
Atualizado
2026-06-04
·
CVE-2024-21490
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
angular versions 1.3.0 and later
Description
A regular expression used to split the value of the
ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.Recommendations
For versions 1.3.0 and later, migrate to
@angular/core as the package is EOL and will not receive any updates to address this issue.
As a temporary workaround, consider restricting the use of the ng-srcset directive until a patch is available.Exploit
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Debian
Linuxmint
Ubuntu
Angular