cve/2024/CVE-2024-21490.md

CVE-2024-21490

Description

This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.

Note:

This package is EOL and will not receive any updates to address this issue. Users should migrate to @angular/core.

POC

Reference

• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747
• https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113
• https://support.herodevs.com/hc/en-us/articles/25715686953485-CVE-2024-21490-AngularJS-Regular-Expression-Denial-of-Service-ReDoS

Github

• https://github.com/fkie-cad/nvd-json-data-feeds
• https://github.com/patrikx3/redis-ui