Skip to content
Sign in
7.5 High

CVE-2023-3223 A flaw was found in undertow

Description

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

Affected products and versions

Product Affected versions Fixed in
Red Hat Fuse 7.12.1 Versions not published
Red Hat JBoss Enterprise Application Platform 7.1.0 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Versions not published
Red Hat Single Sign-On 7.6.5 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 7 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 8 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 9 Versions not published
Show the 12 other branches
Product Affected versions Fixed in
RHEL-8 based Middleware Containers 7.6 earliest → < 7.6-27 7.6-27
Red Hat build of Quarkus Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Decision Manager 7 Versions not published
Red Hat Integration Camel K Versions not published
Red Hat Integration Service Registry Versions not published
Red Hat JBoss Data Grid 7 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat JBoss Fuse 6 Versions not published
Red Hat OpenStack Platform 13 (Queens) Operational Tools Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat support for Spring Boot Versions not published
Track this CVE