PT-2022-20927 · Apache · Apache Tapestry

Atorralba + 3 · Published 2022-07-13 · Updated 2023-08-02 · CVE-2022-31781

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Tapestry versions up to 5.8.1

Description The issue is related to a Regular Expression Denial of Service (ReDoS) in the way Apache Tapestry handles Content Types. Specially crafted Content Types can cause catastrophic backtracking, taking exponential time to complete, due to the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. This vulnerability cannot be triggered by web requests in Tapestry code alone and would only occur if non-Tapestry code passes outside input to the ContentType class constructor.

Recommendations For Apache Tapestry versions up to 5.8.1, update to version 5.8.2 to resolve the issue. As a temporary workaround, consider restricting the use of the org.apache.tapestry5.http.ContentType class to minimize the risk of exploitation, especially when handling outside input.

Fix

Resource Exhaustion

DoS

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2022-31781

GHSA-227G-7CVV-6FF3

Affected Products

Apache Tapestry

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-31781 · Security Note
• https://osv.dev/vulnerability/GHSA-227g-7cvv-6ff3 · Vendor Advisory
• https://openwall.com/lists/oss-security/2022/07/12/3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31781 · Vendor Advisory
• https://github.com/apache/tapestry-5/commit/3c8d6103832eec3bc06029dd2532f06df717431f · Note
• https://t.me/cvenotify/33495 · Telegram Post
• https://t.me/cvenotify/32986 · Telegram Post