CVE-2023-3223highCWE-789

Undertow: outofmemoryerror due to @multipartconfig handling

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 2.7%

probabilidade de exploração

2.7%top 15% das CVEs

exploração observada

nãonenhuma fonte reporta

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Produtos afetados

Red Hat · Red Hat build of Quarkus Red Hat · Red Hat Data Grid 8 Red Hat · Red Hat Decision Manager 7 Red Hat · Red Hat Fuse 7.12.1 Red Hat · Red Hat Integration Camel K Red Hat · Red Hat Integration Service Registry Red Hat · Red Hat JBoss Data Grid 7 Red Hat · Red Hat JBoss Enterprise Application Platform 7.1.0 Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat · Red Hat JBoss Fuse 6 Red Hat · Red Hat OpenStack Platform 13 (Queens) Operational Tools Red Hat · Red Hat Process Automation 7 Red Hat · Red Hat Single Sign-On 7.6.5 Red Hat · Red Hat Single Sign-On 7.6 for RHEL 7 Red Hat · Red Hat Single Sign-On 7.6 for RHEL 8 Red Hat · Red Hat Single Sign-On 7.6 for RHEL 9 Red Hat · Red Hat support for Spring Boot Red Hat · RHEL-8 based Middleware Containers

Referências