Timing Side Channel Vulnerability in Apache Tapestry Form Submissions

CVE-2019-10071

Summary

The vulnerability arises from the use of String.equals() for HMAC signature comparisons in Apache Tapestry form submissions. This method introduces a timing side channel, allowing an attacker to discover the correct HMAC signature for a malicious payload, potentially enabling remote code execution. A more secure constant time algorithm should be employed for HMAC comparisons to mitigate this risk.

References