Vulnerability Description
OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProject has a `quote` method that implements the logic behind the Quote button in the discussion forums, and it uses a regex to strip `<pre>` tags from the message being quoted. The `(.|\s)` part can match a space character in two ways, so an unterminated `<pre>` tag containing `n` spaces causes Ruby's regex engine to backtrack to try 2<sup>n</sup> states in the NFA. This will result in a Regular Expression Denial of Service. The issue is fixed in OpenProject 11.3.3. As a workaround, one may install the patch manually.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openproject | Openproject | < 11.3.3 |
Related Weaknesses (CWE)
References
- https://github.com/opf/openproject/pull/9447.patchPatchThird Party Advisory
- https://github.com/opf/openproject/security/advisories/GHSA-qqvp-j6gm-q56fPatchThird Party Advisory
- https://github.com/opf/openproject/pull/9447.patchPatchThird Party Advisory
- https://github.com/opf/openproject/security/advisories/GHSA-qqvp-j6gm-q56fPatchThird Party Advisory
FAQ
What is CVE-2021-32763?
CVE-2021-32763 is a vulnerability with a CVSS score of 4.3 (MEDIUM). OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProject has a `quote` method that implements the logic behind the ...
How severe is CVE-2021-32763?
CVE-2021-32763 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-32763?
Check the references section above for vendor advisories and patch information. Affected products include: Openproject Openproject.