Описание
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, to optimize client-side bootstrap in Server-Side Rendered (SSR) environments, Angular supports Hydration via provideClientHydration(). During SSR, Angular serializes the application's runtime state (such as cached HttpClient responses) and outputs it into the HTML stream as a
Отчет
Red Hat products do not ship an @angular/core version within the vulnerable range (>= 22.0.0-next.0, < 22.0.1). Additionally, no Red Hat product ships or uses Angular's Server-Side Rendering hydration feature (@angular/platform-server, @angular/ssr, provideClientHydration()) that this vulnerability depends on. Existing Angular usage in Red Hat's portfolio (Red Hat Advanced Cluster Management's volsync UI, Red Hat Integration Service Registry UI) uses versions outside the vulnerable range and does not implement client hydration with untrusted input bound to DOM element IDs.
Меры по смягчению последствий
No mitigation is required. Red Hat products are not affected by this vulnerability, as detailed in the statement above.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/volsync-operator-bundle | Not affected | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/volsync-rhel9 | Not affected | ||
| Red Hat build of Apicurio Registry 3 | apicurio/apicurio-registry-ui-rhel8 | Not affected | ||
| Red Hat build of Apicurio Registry 3 | apicurio/apicurio-registry-ui-rhel9 | Not affected | ||
| Red Hat Ceph Storage 4 | ceph | Not affected | ||
| Red Hat Enterprise Linux 10 | ceph | Not affected | ||
| Red Hat Enterprise Linux 10 | firefox | Not affected | ||
| Red Hat Enterprise Linux 10 | gjs | Not affected | ||
| Red Hat Enterprise Linux 10 | intel-cmt-cat | Not affected | ||
| Red Hat Enterprise Linux 10 | thunderbird | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
4.7 Medium
CVSS3
Связанные уязвимости
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, to optimize client-side bootstrap in Server-Side Rendered (SSR) environments, Angular supports Hydration via provideClientHydration(). During SSR, Angular serializes the application's runtime state (such as cached HttpClient responses) and outputs it into the HTML stream as a <script> tag with a predictable identifier. During client bootstrap, Angular recovers this state by looking up the element via document.getElementById('ng-state') and parsing its text content. Because the DOM element lookup for the state container is predictable and relies solely on the ID selector (ng-state), it is susceptible to DOM Clobbering. If the application binds untrusted user input or CMS content to element properties such as id (e.g., <div [id]="userInput"> or <a id="ng-state">) before the genuine <script> tag is parsed by the brows...
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, to optimize client-side bootstrap in Server-Side Rendered (SSR) environments, Angular supports Hydration via provideClientHydration(). During SSR, Angular serializes the application's runtime state (such as cached HttpClient responses) and outputs it into the HTML stream as a <script> tag with a predictable identifier. During client bootstrap, Angular recovers this state by looking up the element via document.getElementById('ng-state') and parsing its text content. Because the DOM element lookup for the state container is predictable and relies solely on the ID selector (ng-state), it is susceptible to DOM Clobbering. If the application binds untrusted user input or CMS content to element properties such as id (e.g., <div [id]="userInput"> or <a id="ng-state">) before the genuine <script> tag is parsed by the browser,
Angular is a development platform for building mobile and desktop web ...
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
EPSS
4.7 Medium
CVSS3