PT-2021-19912 · Unknown · Openproject

Oliverguenther · Published 2021-07-20 · Updated 2024-03-06 · CVE-2021-32763

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 11.3.3

Description The issue concerns the MessagesController class in OpenProject, specifically the quote method, which is used for the Quote button in discussion forums. This method uses a regex to remove <pre> tags from quoted messages. However, the regex can be exploited to cause a Regular Expression Denial of Service due to its backtracking behavior when encountering an unterminated <pre> tag with a large number of spaces.

Recommendations For versions prior to 11.3.3, update to OpenProject 11.3.3 to resolve the issue. As a temporary workaround, one may install the patch manually.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BIT-OPENPROJECT-2021-32763

CVE-2021-32763

GHSA-QQVP-J6GM-Q56F

Affected Products

Openproject

References · 5

• https://github.com/opf/openproject/security/advisories/GHSA-qqvp-j6gm-q56f · Patch
• https://github.com/opf/openproject/pull/9447.patch · Patch
• https://osv.dev/vulnerability/CVE-2021-32763 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-openproject-2021-32763 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32763 · Security Note