CVE-2023-3223

HIGH

Redhat Undertow < 2.2.24 - Denial of Service

Title source: rule

Description

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

References (13)

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2023:4505

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2023:4506

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2023:4507

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2023:4509

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2023:4918

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2023:4919

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2023:4920

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2023:4921

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2023:4924

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2023:7247

[Vendor Advisory] https://access.redhat.com/security/cve/CVE-2023-3223

[Issue Tracking, Vendor Advisory] https://bugzilla.redhat.com/show_bug.cgi?id=2209689

[Vendor Advisory] https://security.netapp.com/advisory/ntap-20231027-0004/

Scores

CVSS v3 7.5

EPSS 0.0088

EPSS Percentile 75.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-789

Status published

Affected Products (12)

redhat/undertow < 2.2.24

redhat/openshift_container_platform

redhat/openshift_container_platform

redhat/openshift_container_platform_for_ibm_linuxone

redhat/openshift_container_platform_for_ibm_linuxone

redhat/openshift_container_platform_for_power

redhat/openshift_container_platform_for_power

redhat/jboss_enterprise_application_platform_text-only_advisories

redhat/single_sign-on

redhat/single_sign-on

redhat/jboss_enterprise_application_platform

io.undertow/undertow-parent < 2.2.24.FinalMaven

Timeline

Published Sep 27, 2023

Tracked Since Feb 18, 2026