A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2023:4505 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:4506 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:4507 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:4509 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:4918 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:4919 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:4920 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:4921 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:4924 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:7247 | |
| https://access.redhat.com/security/cve/CVE-2023-3223 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2209689 | Issue Tracking Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20231027-0004/ |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
History
03 May 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-27 15:18
Updated : 2024-05-03 16:15
NVD link : CVE-2023-3223
Mitre link : CVE-2023-3223
CVE.ORG link : CVE-2023-3223
JSON object : View
Products Affected
redhat
- jboss_enterprise_application_platform
- openshift_container_platform
- jboss_enterprise_application_platform_text-only_advisories
- enterprise_linux
- openshift_container_platform_for_ibm_linuxone
- single_sign-on
- undertow
- openshift_container_platform_for_power
CWE