CVE-2022-29158: Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz
Published Sep 2, 2022
·Updated
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599
Affected Software
1 affected component
Apache OFBiz<18.12.06
Remediation
Patch Available
Event History
Sep 2, 2022
CVE Published
via MITRE·07:10 AM
Data Sourced
via MITRE·07:10 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-29158?
The severity of CVE-2022-29158 is high with a score of 7.5.
2
How does CVE-2022-29158 impact Apache OFBiz?
CVE-2022-29158 affects Apache OFBiz up to version 18.12.05 and can lead to Regular Expression Denial of Service (ReDoS) when handling URLs provided by external, unauthenticated users.
3
How can I fix CVE-2022-29158?
To fix CVE-2022-29158, you should upgrade Apache OFBiz to version 18.12.06 or apply the patches provided at https://issues.apache.org/jira/browse/OFBIZ-12599.
4
What is the CWE ID for CVE-2022-29158?
The CWE ID for CVE-2022-29158 is 1333.