Vulnerability in Apache Tapestry
CVE-2022-31781
Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. Apache Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapestry code alone. It would only happen if there's some non-Tapestry codepath passing some outside input to the ContentType class constructor.
Vulnerability class: ReDoS (Regular Expression Denial of Service)
EPSS: 0.019 (78.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Apache Tapestry
- Apache Software Foundation Tapestry — versions 5.8.1
Weakness classification (CWE)
References
- security@apache.org (Mailing List, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-31781?
- CVE-2022-31781 is a high-severity vulnerability in Apache Tapestry, classified under Inefficient Regular Expression Complexity. CVSS score: 7.5/10. Published 2022-07-13.
- How severe is CVE-2022-31781?
- High severity. CVSS v3 base score is 7.5 out of 10.