Undertow: outofmemoryerror due to @multipartconfig handling
CVE-2023-3223

7.5HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Fuse 7.12.1
Red Hat Jboss Enterprise Application Platform 7.1.0
Red Hat Jboss Enterprise Application Platform 7.4 For Rhel 8
Red Hat Jboss Enterprise Application Platform 7.4 For Rhel 9
Vendor
CVE Published:
27 September 2023

What is CVE-2023-3223?

A vulnerability has been identified in Undertow, where servlets annotated with @MultipartConfig may lead to an OutOfMemoryError during processing of large multipart content submissions. This flaw can enable unauthorized users to launch remote Denial of Service attacks. Importantly, if file size thresholds are employed to restrict uploads, attackers can bypass these limits by manipulating the request to set the file name to null, thus exploiting this weakness.

Affected Version(s)

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:2.2.25-3.SP3_redhat_00001.1.el8eap

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 0:2.2.25-3.SP3_redhat_00001.1.el9eap

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 0:2.2.25-3.SP3_redhat_00001.1.el7eap

References

https://access.redhat.com/errata/RHSA-2023:4505
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:4506
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:4507
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Keke Lian & Haoran Zhao (SecSys Lab) for reporting this issue.
.