CVE-2022-25844 (High) detected in angular-1.8.2.tgz - autoclosed #1558
Labels
cve
Security vulnerabilities detected by Dependabot or Mend
de-angular
de-angularize work
dependencies
Pull requests that update a dependency file
high severity
High severity CVE
Mend: dependency security vulnerability
Security vulnerability detected by Mend
v2.11.0
CVE-2022-25844 - High Severity Vulnerability
Vulnerable Library - angular-1.8.2.tgz
HTML enhanced for web apps
Library home page: https://registry.npmjs.org/angular/-/angular-1.8.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/angular/package.json,/node_modules/angular/package.json
Dependency Hierarchy:
Found in HEAD commit: cba076465f44b6a819e3cff7986ff4cd21a66371
Found in base branch: main
Vulnerability Details
The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. Note: 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.
Publish Date: 2022-05-01
URL: CVE-2022-25844
CVSS 3 Score Details (7.5)
Base Score Metrics:
The text was updated successfully, but these errors were encountered: