Description
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
Remediation
References
https://access.redhat.com/errata/RHSA-2023:4505
https://access.redhat.com/errata/RHSA-2023:4506
https://access.redhat.com/errata/RHSA-2023:4507
https://access.redhat.com/errata/RHSA-2023:4509
https://access.redhat.com/errata/RHSA-2023:4918
https://access.redhat.com/errata/RHSA-2023:4919
https://access.redhat.com/errata/RHSA-2023:4920
https://access.redhat.com/errata/RHSA-2023:4921
https://access.redhat.com/errata/RHSA-2023:4924
https://access.redhat.com/errata/RHSA-2023:7247
https://access.redhat.com/security/cve/CVE-2023-3223
https://bugzilla.redhat.com/show_bug.cgi?id=2209689
https://security.netapp.com/advisory/ntap-20231027-0004/
Related Vulnerabilities
CVE-2018-1114 Vulnerability in maven package io.undertow:undertow-core
CVE-2019-10289 Vulnerability in maven package org.jenkins-ci.plugins:netsparker-cloud-scan
CVE-2015-5345 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2014-4611 Vulnerability in maven package net.jpountz.lz4:lz4
CVE-2019-12421 Vulnerability in maven package org.apache.nifi:nifi-web-api