CVE-2019-10071
- State
- Published
- Severity
- Not scored
- Published
- Sep 16, 2019
- Updated
- Aug 4, 2024
- Reserved
- Mar 26, 2019
Description
The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache TapestryApache |
|
References
- [tapestry-users] 20190913 CVE-2019-10071: Apache Tapestry vulnerability disclosuremailing-list
- [tapestry-users] 20191007 Re: CVE-2019-10071: Apache Tapestry vulnerability disclosuremailing-list
- [tapestry-users] 20191014 Re: CVE-2019-10071: Apache Tapestry vulnerability disclosuremailing-list
- [tapestry-commits] 20200111 svn commit: r1055136 [2/2] - in /websites/production/tapestry/content: cache/main.pageCache component-rendering.html content-type-and-markup.html dom.html https.html request-processing.html response-compression.html security.html url-rewriting.htmlmailing-list
- [tapestry-commits] 20200531 svn commit: r1061326 [4/4] - in /websites/production/tapestry/content: ./ cache/mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.