CVE-2023-3223
Fixed in a distro release EPSS 3%CVSS 7.5
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
Products: Red Hat Fuse 7.12.1, Red Hat JBoss Enterprise Application Platform 7.1.0, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9, Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7, Red Hat Single Sign-On 7.6.5, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, Red Hat RHEL-8 based Middleware Containers, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Decision Manager 7, Red Hat Integration Camel K, Red Hat Integration Service Registry, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Fuse 6, Red Hat OpenStack Platform 13 (Queens) Operational Tools, Red Hat Process Automation 7, Red Hat support for Spring Boot
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | io.undertow:undertow-parent | 2.2.24.Final |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 14 | undertow | 2.3.18-1 |
| Red Hat jboss enterprise application platform 7.4 | eap7-jettison | 0:1.5.4-1.redhat_00002.1.el7eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-jettison | 0:1.5.4-1.redhat_00002.1.el9eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-jettison | 0:1.5.4-1.redhat_00002.1.el8eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-undertow | 0:2.2.25-3.SP3_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-undertow | 0:2.2.25-3.SP3_redhat_00001.1.el8eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-undertow | 0:2.2.25-3.SP3_redhat_00001.1.el9eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly | 0:7.4.12-3.GA_redhat_00003.1.el7eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly | 0:7.4.12-3.GA_redhat_00003.1.el8eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly | 0:7.4.12-3.GA_redhat_00003.1.el9eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly-java-jdk11 | 0:7.4.12-3.GA_redhat_00003.1.el9eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly-java-jdk11 | 0:7.4.12-3.GA_redhat_00003.1.el7eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly-java-jdk11 | 0:7.4.12-3.GA_redhat_00003.1.el8eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly-java-jdk17 | 0:7.4.12-3.GA_redhat_00003.1.el8eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly-java-jdk17 | 0:7.4.12-3.GA_redhat_00003.1.el9eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly-java-jdk8 | 0:7.4.12-3.GA_redhat_00003.1.el9eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly-java-jdk8 | 0:7.4.12-3.GA_redhat_00003.1.el8eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly-java-jdk8 | 0:7.4.12-3.GA_redhat_00003.1.el7eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly-javadocs | 0:7.4.12-3.GA_redhat_00003.1.el8eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly-javadocs | 0:7.4.12-3.GA_redhat_00003.1.el9eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly-javadocs | 0:7.4.12-3.GA_redhat_00003.1.el7eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly-modules | 0:7.4.12-3.GA_redhat_00003.1.el8eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly-modules | 0:7.4.12-3.GA_redhat_00003.1.el9eap |
| Red Hat jboss enterprise application platform 7.4 | eap7-wildfly-modules | 0:7.4.12-3.GA_redhat_00003.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis-cli | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis-commons | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis-core-client | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis-dto | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis-hornetq-protocol | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis-hqclient-protocol | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis-jdbc-store | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis-jms-client | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis-jms-server | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis-journal | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis-native | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis-ra | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis-selector | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis-server | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-activemq-artemis-service-extensions | 0:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-artemis-native | 1:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-artemis-native-debuginfo | 1:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-artemis-native-wildfly | 1:1.5.5.016-1.redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-jboss-xnio-base | 0:3.5.11-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-jsoup | 0:1.14.2-1.redhat_00002.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-undertow | 0:1.4.18-14.SP13_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly | 0:7.1.10-2.GA_redhat_00002.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly-modules | 0:7.1.10-2.GA_redhat_00002.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-woodstox-core | 0:5.0.3-2.redhat_00002.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-xml-security | 0:2.0.10-2.redhat_00002.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-annotations | 0:2.10.4-3.redhat_00006.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-core | 0:2.10.4-3.redhat_00006.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-databind | 0:2.10.4-5.redhat_00006.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-datatype-jdk8 | 0:2.10.4-2.redhat_00006.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-datatype-jsr310 | 0:2.10.4-2.redhat_00006.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-jaxrs-base | 0:2.10.4-3.redhat_00006.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-jaxrs-json-provider | 0:2.10.4-3.redhat_00006.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-jaxrs-providers | 0:2.10.4-3.redhat_00006.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-module-jaxb-annotations | 0:2.10.4-5.redhat_00006.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-modules-base | 0:2.10.4-5.redhat_00006.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-modules-java8 | 0:2.10.4-2.redhat_00006.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-cli | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-core | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-eap6.4 | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-eap6.4-to-eap7.3 | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-eap7.0 | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-eap7.1 | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-eap7.2 | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-eap7.2-to-eap7.3 | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-eap7.3-server | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-wildfly10.0 | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-wildfly10.1 | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-wildfly11.0 | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-wildfly12.0 | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-wildfly13.0-server | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-wildfly14.0-server | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-wildfly15.0-server | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-wildfly16.0-server | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-wildfly17.0-server | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-wildfly18.0-server | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-wildfly8.2 | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jboss-server-migration-wildfly9.0 | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-netty | 0:4.1.63-5.Final_redhat_00003.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-netty-all | 0:4.1.63-5.Final_redhat_00003.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-undertow | 0:2.0.41-4.SP5_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-wildfly | 0:7.3.14-3.GA_redhat_00002.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-wildfly-elytron | 0:1.10.17-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-wildfly-elytron-tool | 0:1.10.17-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-wildfly-java-jdk11 | 0:7.3.14-3.GA_redhat_00002.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-wildfly-java-jdk8 | 0:7.3.14-3.GA_redhat_00002.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-wildfly-javadocs | 0:7.3.14-3.GA_redhat_00002.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-wildfly-modules | 0:7.3.14-3.GA_redhat_00002.1.el7eap |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.9-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.9-1.redhat_00001.1.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.9-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.9-1.redhat_00001.1.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.9-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.9-1.redhat_00001.1.el7sso |
| Ubuntu 25.10 | undertow | no fix |
| Ubuntu 26.04 LTS | undertow | no fix |
| Ubuntu 26.10 | undertow | no fix |
| Ubuntu Pro 16.04 LTS | undertow | no fix |
| Ubuntu Pro 18.04 LTS | undertow | no fix |
| Ubuntu Pro 20.04 LTS | undertow | no fix |
| Ubuntu Pro 22.04 LTS | undertow | no fix |
| Ubuntu Pro 24.04 LTS | undertow | no fix |