CVE-2022-29158

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-29158

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29158.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-29158

Published

2022-09-02T07:10:20Z

Modified

2026-10-20T10:55:27Z

Summary

Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz

Details

Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599

Database specific

{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-1333"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29158.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "Apache OFBiz"
                },
                {
                    "last_affected":  "18.12.05"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/apache/ofbiz-framework

Affected ranges

Type

GIT

Repo

https://github.com/apache/ofbiz-framework

Events

Introduced

Last Affected

71c853fe8229bce14ec7888f4d0b442944f0dc1f

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "18.12.05"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

release18.*

release18.12.01

release18.12.02

release18.12.03

release18.12.04

release18.12.05

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29158.json"