PT-2023-23673 · Red Hat · Openshift Container Platform For Power+4
Patrick Del Bello
·
Published
2023-09-27
·
Updated
2024-05-03
·
CVE-2023-3223
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
undertow (affected versions not specified)
jboss enterprise application platform (affected versions not specified)
jboss enterprise application platform text-only advisories (affected versions not specified)
openshift container platform (affected versions not specified)
openshift container platform for ibm linuxone (affected versions not specified)
openshift container platform for power (affected versions not specified)
single sign-on (affected versions not specified)
Description
A flaw was found in undertow. Servlets annotated with
@MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.Recommendations
As a temporary workaround, consider disabling the
@MultipartConfig annotation in servlets until a patch is available.
Restrict access to servlets annotated with @MultipartConfig to minimize the risk of exploitation.
Avoid using the fileSizeThreshold parameter to limit file size, and instead, consider implementing additional validation and sanitization of multipart content.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Red Hat Jboss Enterprise Application Platform
Openshift Container Platform
Openshift Container Platform For Ibm Linuxone
Openshift Container Platform For Power
Single Sign-On