GHSA-65h2-wf7m-q2v8
First published: Wed Sep 27 2023(Updated: )
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/io.undertow:undertow-parent | <2.2.24.Final | 2.2.24.Final |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2023-3223
- https://access.redhat.com/errata/RHSA-2023:4505
- https://access.redhat.com/errata/RHSA-2023:4506
- https://access.redhat.com/errata/RHSA-2023:4507
- https://access.redhat.com/errata/RHSA-2023:4509
- https://access.redhat.com/errata/RHSA-2023:4918
- https://access.redhat.com/errata/RHSA-2023:4919
- https://access.redhat.com/errata/RHSA-2023:4920
- https://access.redhat.com/errata/RHSA-2023:4921
- https://access.redhat.com/errata/RHSA-2023:4924
- https://access.redhat.com/security/cve/CVE-2023-3223
- https://bugzilla.redhat.com/show_bug.cgi?id=2209689
- https://github.com/advisories/GHSA-65h2-wf7m-q2v8 (Advisory)
- https://access.redhat.com/errata/RHSA-2023:7247
- https://security.netapp.com/advisory/ntap-20231027-0004
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is GHSA-65h2-wf7m-q2v8.
What is the severity of GHSA-65h2-wf7m-q2v8?
The severity of GHSA-65h2-wf7m-q2v8 is high with a severity value of 7.5.
How does the vulnerability in undertow impact the system?
The vulnerability in undertow can cause an OutOfMemoryError and allow unauthorized users to cause a remote Denial of Service (DoS) attack.
How do I fix GHSA-65h2-wf7m-q2v8?
To fix GHSA-65h2-wf7m-q2v8, upgrade to version 2.2.24.Final or higher of io.undertow:undertow-parent.
Where can I find more information about GHSA-65h2-wf7m-q2v8?
You can find more information about GHSA-65h2-wf7m-q2v8 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-3223), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2023:4505), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2023:4506).
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-65h2-wf7m-q2v8
- alias/CVE-2023-3223
- agent/software-canonical-lookup
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/description
- agent/event
- collector/github-advisory
- agent/trending
- agent/tags
- agent/source
- package-manager/maven