CVE-2021-32763

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
20/07/2021
Last modified:
25/04/2022

Description

OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProject has a `quote` method that implements the logic behind the Quote button in the discussion forums, and it uses a regex to strip `` tags from the message being quoted. The `(.|\s)` part can match a space character in two ways, so an unterminated `` tag containing `n` spaces causes Ruby's regex engine to backtrack to try 2n states in the NFA. This will result in a Regular Expression Denial of Service. The issue is fixed in OpenProject 11.3.3. As a workaround, one may install the patch manually.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:* 11.3.3 (excluding)