CVE-2021-33580: 
NixOS vulnerability analysis and mitigation

CVE-2021-33580 is a regex injection vulnerability discovered in Apache Roller that can lead to Denial of Service (DoS). The vulnerability was disclosed on August 17, 2021, and affects Apache Roller installations where Banned-words Referrer processing is enabled, though this feature is disabled by default (Openwall Report).

The vulnerability stems from user-controlled input fields including request.getHeader("Referer"), request.getRequestURL(), and request.getQueryString() being used to build and execute regex expressions. An attacker can exploit this by sending specially crafted Referer headers programmatically, potentially causing Regular Expression Denial of Service (ReDoS) through regex catastrophic backtracking on the server side. The vulnerability is classified as CWE-400 (NVD Report).

The primary impact of this vulnerability is the potential for Denial of Service attacks against Apache Roller servers that have Banned-words Referrer processing enabled. The severity is classified as Low since the vulnerable feature is disabled by default (Openwall Report).

The vulnerability has been patched in Apache Roller version 6.0.2. For users unable to upgrade, a workaround is available by disabling the Banned-Words Referrer processing feature by setting the property 'site.bannedwordslist.enable.referrers=false' in the Roller properties (Openwall Report).