Denial of Service Vulnerability in Angular.js - Catastrophic Backtracking Risk
Summary
DEBIAN-CVE-2024-21490: This affects versions of the package angular from 1.3.0. Affects angular.js versions < 1.8.3-1+deb12u1~deb11u1. Fixed in 1.8.3-1+deb12u1~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Angular.js is a widely-used JavaScript framework designed for building dynamic web applications. It allows developers to create single-page applications with a rich user experience. However, certain versions of Angular.js are vulnerable to a denial of service attack due to a flaw in the regular expression used in the ng-srcset directive, which can lead to performance degradation under specific conditions.
Vulnerability Detail
The vulnerability arises from a regular expression used to split the value of the ng-srcset directive, which is susceptible to super-linear runtime due to backtracking. When large and carefully-crafted input is processed, it can cause catastrophic backtracking, leading to a denial of service. This affects versions of Angular.js starting from 1.3.0, and it is critical for users to be aware of this issue as it can severely impact application performance.
How To Fix
Minimum fixed version
1.8.3-1+deb12u1~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade angular.jsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users are advised to migrate to the newer @angular/core package, which is actively maintained and does not have this vulnerability. This can be done by updating the project dependencies in the package.json file and running npm install.
Conclusion
The vulnerability in Angular.js poses a significant risk of denial of service due to catastrophic backtracking in the ng-srcset directive. Users are strongly encouraged to update to the patched versions or migrate to the newer @angular/core package to ensure their applications remain secure.
See every vulnerability recorded for angular.js →
FAQ
The vulnerability is related to a regular expression in the ng-srcset directive that can lead to denial of service due to catastrophic backtracking.
Versions starting from 1.3.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If updating is not possible, consider migrating to the @angular/core package, which is actively maintained and does not have this vulnerability.
No, the Angular.js package is end-of-life (EOL) and will not receive any updates to address this issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for angular.js.
