PT-2023-4755 · Google+1 · Angular+1

George Kalpakas + 1 · Published 2023-03-30 · Updated 2026-01-14 · CVE-2023-26116

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions angular versions 1.2.21 and later

Description The issue is related to the angular.copy() utility function, which uses an insecure regular expression. This can lead to a Regular Expression Denial of Service (ReDoS) via a large carefully-crafted input, resulting in catastrophic backtracking. Exploiting this issue is possible, allowing a remote attacker to cause a denial of service.

Recommendations For versions 1.2.21 and later, consider disabling the angular.copy() function until a patch is available to prevent potential exploitation. Restricting the input to the angular.copy() function can also help minimize the risk of catastrophic backtracking. As a temporary workaround, avoid using large inputs that could trigger the insecure regular expression. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

BDU:2023-05195

CVE-2023-26116

DLA-4242-1

GHSA-2VRF-HF26-JRP5

USN-7958-1

Affected Products

Debian

Angular

References · 37

• 🔥 https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373044 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406322 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406321 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406320 · Exploit
• 🔥 https://stackblitz.com/edit/angularjs-vulnerability-angular-copy-redos · Exploit
• https://ubuntu.com/security/CVE-2023-26117 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14863 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-25844 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26116 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-26116 · Security Note
• https://ubuntu.com/security/notices/USN-7958-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26116 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-26116 · Vendor Advisory