CVE-2022-29158

Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz

EPSS 1.7%CWE-1333

Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599

Affected products

Apache Software Foundation · Apache OFBiz

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://lists.apache.org/thread/7k92rg1o4ql2yw3o0vttkcl2jhq7j928 http://www.openwall.com/lists/oss-security/2022/09/02/5