CVE-2022-25844

SOURCE - github

Summary

AngularJS lets users write client-side web applications. The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value.

Note:

This package has been deprecated and is no longer maintained.
The vulnerable versions are 1.7.0 and higher.

EPSS Score⁠: 0.01458 (0.870)

Common Weakness Enumeration (CWE)

SOURCE - nist

CWE-1333⁠

Inefficient Regular Expression Complexity

SOURCE - github

CWE-1333⁠

Inefficient Regular Expression Complexity

CWE-770⁠

Allocation of Resources Without Limits or Throttling

SOURCE - gitlab

CWE-1035⁠

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

CWE-1333⁠

Inefficient Regular Expression Complexity

CWE-937⁠

OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities

SOURCE - redhat

CWE-770⁠

Allocation of Resources Without Limits or Throttling

Impacted images

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.