CVE-2019-10071: Critical severity apache tapestry vulnerability
The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10071?
The severity of CVE-2019-10071 is critical with a severity value of 9.8.
What is the affected software for CVE-2019-10071?
The affected software for CVE-2019-10071 is Apache Tapestry version 5.4.0 to 5.4.3.
What is the vulnerability description of CVE-2019-10071?
CVE-2019-10071 is a vulnerability in Apache Tapestry that allows for remote code execution due to a timing side channel in HMAC signature comparisons.
How can an attacker exploit CVE-2019-10071?
An attacker can exploit CVE-2019-10071 by determining the correct signature for their payload, leading to remote code execution.
Are there any references for CVE-2019-10071?
Yes, you can find references for CVE-2019-10071 at the following links: [Link 1](https://lists.apache.org/thread.html/6e8f42c88da7be3c60aafe3f6a85eb00b4f8b444de26b38d36233a43@%3Cusers.tapestry.apache.org%3E), [Link 2](https://lists.apache.org/thread.html/7a437dad5af7309aba4d01bfc2463b3ac34e6aafaa565381d3a36460@%3Cusers.tapestry.apache.org%3E), [Link 3](https://lists.apache.org/thread.html/bac8d6f9e1b4059b319d9cba6f33219a99b81623476ec896138f851c@%3Cusers.tapestry.apache.org%3E)