ManageIQ / ManageIQ/ui-components
CVE-2022-25844 (Medium) detected in angular-1.8.3.tgz
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 16
- Forks
- 55
- PR merge metrics
- No merged PRs in 30d
Description
CVE-2022-25844 - Medium Severity Vulnerability
Vulnerable Library - angular-1.8.3.tgz
HTML enhanced for web apps
Library home page: https://registry.npmjs.org/angular/-/angular-1.8.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/angular-npm-1.8.3-0e5e833690-10.zip
Dependency Hierarchy:
- angular-ui-sortable-0.19.0.tgz (Root Library)
- ❌ angular-1.8.3.tgz (Vulnerable Library)
Found in HEAD commit: a5db0714038685437d759b29eb80b4b9e415b2c2
Found in base branch: master
Vulnerability Details
The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. Note: 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2022-05-01
URL: CVE-2022-25844
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Step up your Open Source Security Game with Mend here
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with package.json, the dependency hierarchy, and the angular-ui-sortable dependency named in the report. Determine how angular 1.8.3 is introduced and identify a supported remediation for CVE-2022-25844; done means the vulnerable dependency is no longer present and the dependency state is verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- angular
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100