Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2024-21490

Description

This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. **Note:** This package is EOL and will not receive any updates to address this issue. Users should migrate to @angular/core.

POC

Reference

- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746

- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747

- https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113

Github

- https://github.com/eleni1029/250714_Weakness_Scan

- https://github.com/fkie-cad/nvd-json-data-feeds

- https://github.com/patrikx3/redis-ui

- https://github.com/w4zu/Debian_security