Bug 2080945 (CVE-2022-25844)

Summary:	CVE-2022-25844 angular: Regular Expression Denial of Service (ReDoS) in angular
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	agerstmayr, aileenc, aoconnor, asoldano, bbaranow, bbuckingham, bcourt, bdettelb, bmaxwell, bniver, boliveir, brian.stansberry, cdewolf, chazlett, darran.lofthouse, decathorpe, dkreling, dosoudil, eclipseo, eglynn, ehelms, fjuma, flucifre, fmuellner, fzatlouk, gecko-bugs-nobody, ggaughan, gmalinko, gmeno, go-sig, grafana-maint, iweiss, janstey, jhorak, jjoyce, jkurik, jochrist, jsherril, jwendell, jwon, kai-engert-fedora, klaas, lgao, lhh, lzap, madko, mbenjamin, mburns, mgoodwin, mhackett, mhulan, mosmerov, msochure, msvehla, nathans, nmoumoul, nwallace, orabin, pcreech, pdelbell, pdrozd, pjasicek, pjindal, pmackay, pskopek, rcernich, rchan, rhughes, rstancel, rstrode, rsvoboda, sandmann, smaestri, sostapov, spower, sthorger, stransky, tom.jenkinson, tpopela, trpost, twalsh, vereddy
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Angular package. The angular package is vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2081180, 2081586, 2082541, 2082542
Bug Blocks:	2080948

Description Avinash Hanwate 2022-05-02 12:22:00 UTC

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. **Note:** 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2772737
https://snyk.io/vuln/SNYK-JS-ANGULAR-2772735
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2772736
https://stackblitz.com/edit/angularjs-material-blank-zvtdvb
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2772738

Comment 1 Anten Skrabec 2022-05-02 22:40:42 UTC

Created grafana tracking bugs for this issue:

Affects: fedora-all [bug 2081180]

Comment 6 Avinash Hanwate 2022-05-06 11:54:23 UTC

Created glances tracking bugs for this issue:

Affects: epel-8 [bug 2082542]