CVE-2023-3223 — Undertow: outofmemoryerror due to @multipartconfig handling

Description (CNA)

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

Affected (CNA)

Vendor / product	Versions
Red Hat / Red Hat Fuse 7.12.1	unaffected
Red Hat / Red Hat JBoss Enterprise Application Platform 7.1.0	unaffected
Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	unaffected 0:2.2.25-3.SP3_redhat_00001.1.el8eap before *
Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	unaffected 0:2.2.25-3.SP3_redhat_00001.1.el9eap before *
Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7	unaffected 0:2.2.25-3.SP3_redhat_00001.1.el7eap before *
Red Hat / Red Hat Single Sign-On 7.6.5	unaffected
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 7	unaffected 0:18.0.9-1.redhat_00001.1.el7sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 8	unaffected 0:18.0.9-1.redhat_00001.1.el8sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 9	unaffected 0:18.0.9-1.redhat_00001.1.el9sso before *
Red Hat / RHEL-8 based Middleware Containers	unaffected 7.6-27 before *
Red Hat / Red Hat build of Quarkus	unaffected
Red Hat / Red Hat Data Grid 8	unaffected
Red Hat / Red Hat Decision Manager 7	affected
Red Hat / Red Hat Integration Camel K	affected
Red Hat / Red Hat Integration Service Registry	affected
Red Hat / Red Hat JBoss Data Grid 7	unknown
Red Hat / Red Hat JBoss Enterprise Application Platform Expansion Pack	unaffected
Red Hat / Red Hat JBoss Fuse 6	unknown
Red Hat / Red Hat OpenStack Platform 13 (Queens) Operational Tools	unknown
Red Hat / Red Hat Process Automation 7	affected
Red Hat / Red Hat support for Spring Boot	unaffected

CWE

CWE-789

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.