CVEvulnerability
CVE-2022-29158
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-09-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-1333
Description
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599
Affected configurations
• apache ofbiz (< 18.12.06)
Related
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness
References
- http://www.openwall.com/lists/oss-security/2022/09/02/5 Mailing List, Patch, Third Party Advisory
- https://lists.apache.org/thread/7k92rg1o4ql2yw3o0vttkcl2jhq7j928 Mailing List, Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2022/09/02/5 Mailing List, Patch, Third Party Advisory
- https://lists.apache.org/thread/7k92rg1o4ql2yw3o0vttkcl2jhq7j928 Mailing List, Patch, Vendor Advisory