CVE-2023-3223

Published: Sep 27, 2023

Modified: Aug 2, 2024

PUBLISHED

CVSS v3.1

7.5

HIGH

Description

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

Vendor	Product	Versions
Red Hat	Red Hat Fuse 7.12.1	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 7.1.0	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	unaffected `0:2.2.25-3.SP3_redhat_00001.1.el8eap - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	unaffected `0:2.2.25-3.SP3_redhat_00001.1.el9eap - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7	unaffected `0:2.2.25-3.SP3_redhat_00001.1.el7eap - < *`
Red Hat	Red Hat Single Sign-On 7.6.5	All versions
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 7	unaffected `0:18.0.9-1.redhat_00001.1.el7sso - < *`
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 8	unaffected `0:18.0.9-1.redhat_00001.1.el8sso - < *`
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 9	unaffected `0:18.0.9-1.redhat_00001.1.el9sso - < *`
Red Hat	RHEL-8 based Middleware Containers	unaffected `7.6-27 - < *`
Red Hat	Red Hat build of Quarkus	All versions
Red Hat	Red Hat Data Grid 8	All versions
Red Hat	Red Hat Decision Manager 7	All versions
Red Hat	Red Hat Integration Camel K	All versions
Red Hat	Red Hat Integration Service Registry	All versions
Red Hat	Red Hat JBoss Data Grid 7	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	All versions
Red Hat	Red Hat JBoss Fuse 6	All versions
Red Hat	Red Hat OpenStack Platform 13 (Queens) Operational Tools	All versions
Red Hat	Red Hat Process Automation 7	All versions
Red Hat	Red Hat support for Spring Boot	All versions