CVE-2023-3223

Katalog CVE

CVSS 7.5 · High EPSS 2,7%

Kerentanan Memory Allocation with Excessive Size Value pada redhat undertow, redhat openshift container platform +5 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

Rincian

Terbit di NVD

27 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-789: Memory Allocation with Excessive Size Value

EPSS (30 hari)

2,7% peluang dieksploitasi; lebih tinggi dari 85,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2023:4505 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:4506 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:4507 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:4509 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:4918 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:4919 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:4920 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:4921 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:4924 advisory vendor
• https://access.redhat.com/security/cve/CVE-2023-3223 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2209689 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2023:7247
• https://security.netapp.com/advisory/ntap-20231027-0004/