CVE-2022-25844

Publication date 1 May 2022

Last updated 11 July 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

5.3 · Medium

Score breakdown

Description

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ′ ’.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. **Note:** 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.

Status

Package Ubuntu Release Status
angular.js 25.10 questing
Vulnerable
25.04 plucky
Vulnerable
24.10 oracular Ignored end of life, was needed
24.04 LTS noble
Vulnerable
23.10 mantic Ignored end of life, was needed
23.04 lunar Ignored end of life, was needed
22.10 kinetic Ignored end of life, was needed
22.04 LTS jammy
Vulnerable
21.10 impish Ignored end of life
20.04 LTS focal
Vulnerable
18.04 LTS bionic
Not affected
16.04 LTS xenial
Needs evaluation

Severity score breakdown

Parameter Value
Base score 5.3 · Medium
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact Low
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

Other references