CVE-2024-21490

Name	CVE-2024-21490
Description	This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. Note: This package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4242-1
Debian Bugs	1088803

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
angular.js (PTS)	bullseye	1.8.2-2	vulnerable
	bullseye (security)	1.8.3-1+deb12u1~deb11u1	fixed
	bookworm	1.8.3-1+deb12u1	fixed
	forky, sid, trixie	1.8.3-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
angular.js	source	bullseye	1.8.3-1+deb12u1~deb11u1	DLA-4242-1
angular.js	source	bookworm	1.8.3-1+deb12u1
angular.js	source	(unstable)	1.8.3-2		1088803

Notes

[buster] - angular.js <postponed> (Fix along with the next DLA)
https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113
PoC: https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos