Bug 2172298 (CVE-2023-24998)
| Summary: | CVE-2023-24998 Apache Commons FileUpload: FileUpload DoS with excessive parts | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Chess Hazlett <chazlett> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abenaiss, aileenc, alampare, alazarot, anstephe, asoldano, ataylor, avibelli, bbaranow, bbuckingham, bcourt, ben.argyle, bgeorges, bmaxwell, brian.stansberry, btotty, cdewolf, chazlett, cmoulliard, csutherl, darran.lofthouse, dfreiber, dhanak, dkreling, dosoudil, eglynn, ehelms, ellin, emingora, fjuma, fmongiar, gjospin, gmalinko, hbraun, huwang, ibek, ikanello, ivassile, iweiss, janstey, jburrell, jclere, jjoyce, jnethert, jolee, jpavlik, jpechane, jpoth, jrokos, jross, jschatte, jsherril, jstastny, kverlaen, kyoshida, lbacciot, lgao, lhh, lthon, lzap, mburns, mgarciac, mhulan, mmadzin, mnovotny, mokumar, mosmerov, msochure, msvehla, nmoumoul, nwallace, orabin, pcreech, pdelbell, peholase, pgallagh, pjindal, pmackay, rchan, rguimara, rhcs-maint, rjohnson, rkieley, rogbas, rrajasek, rruss, rstancel, scorneli, shbose, smaestri, spower, szappis, tcunning, tom.jenkinson, vkumar, yfang |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | commons-fileupload 1.5 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in Apache Commons FileUpload, where it does not limit the number of parts being processed in a request. This issue may allow an attacker to use a malicious upload or series of uploads to trigger a denial of service.
While Red Hat Satellite relies upon Apache Tomcat, it does not directly ship it. Tomcat is shipped with Red Hat Enterprise Linux and consumed by the Candlepin component of Satellite. Red Hat Satellite users are therefore advised to check the impact state of Red Hat Enterprise Linux, since any necessary fixes will be distributed through the platform.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-05-03 19:45:43 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2173752, 2173753, 2173782, 2174302, 2174303, 2174671, 2174672, 2175798, 2211066, 2211067, 2211068, 2211069, 2211070 | ||
| Bug Blocks: | 2171907 | ||
|
Description
Chess Hazlett
2023-02-21 21:40:00 UTC
Upstream security page: https://commons.apache.org/proper/commons-fileupload/security-reports.html#Fixed_in_Apache_Commons_FileUpload_1.5 Upstream commit: https://github.com/apache/commons-fileupload/commit/e20c04990f7420ca917e96a84cec58b13a1b3d17 Created apache-commons-fileupload tracking bugs for this issue: Affects: epel-7 [bug 2173752] Affects: fedora-all [bug 2173753] Created tomcat tracking bugs for this issue: Affects: fedora-all [bug 2173782] This issue has been addressed in the following products: RHINT Camel-Springboot 3.20.1 Via RHSA-2023:2100 https://access.redhat.com/errata/RHSA-2023:2100 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2023-24998 This issue has been addressed in the following products: OpenShift Developer Tools and Services for OCP 4.13 Via RHSA-2023:3299 https://access.redhat.com/errata/RHSA-2023:3299 Created tomcat tracking bugs for this issue: Affects: epel-8 [bug 2211066] This issue has been addressed in the following products: Red Hat JBoss Web Server 5.7 on RHEL 7 Red Hat JBoss Web Server 5.7 on RHEL 8 Red Hat JBoss Web Server 5.7 on RHEL 9 Via RHSA-2023:4909 https://access.redhat.com/errata/RHSA-2023:4909 This issue has been addressed in the following products: JWS 5.7.4 release Via RHSA-2023:4910 https://access.redhat.com/errata/RHSA-2023:4910 This bug has not been fixed in the Tomcat 9.0.62 for RHEL 8 and RHEL 9 (NOTE: _NOT_ the JBoss Tomcat, the one available to anyone running plain old RHEL 8 or 9). This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:6570 https://access.redhat.com/errata/RHSA-2023:6570 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:7065 https://access.redhat.com/errata/RHSA-2023:7065 |