Bug 2236340 (CVE-2023-26048)
| Summary: | CVE-2023-26048 jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter() | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Patrick Del Bello <pdelbell> |
| Component: | vulnerability | Assignee: | Sayan Biswas <sabiswas> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aileenc, alampare, alazarot, almacdon, anstephe, apjagtap, asatyam, asoldano, ataylor, avibelli, bbaranow, bbuckingham, bcourt, bgeorges, bmaxwell, boliveir, brian.stansberry, ccranfor, cdewolf, chazlett, chfoley, cmiranda, darran.lofthouse, dhanak, diagrawa, dkreling, dosoudil, drichtar, dsimansk, ehelms, emingora, eric.wittmann, fjuma, fmariani, fmongiar, gjospin, gmalinko, ibek, ivassile, iweiss, janstey, jcechace, jkang, jnethert, jpechane, jpoth, jrokos, jross, jscholz, jsherril, jvanek, kverlaen, lbacciot, lball, lgao, lthon, lzap, matzew, mhulan, mizdebsk, mnovotny, mosmerov, msochure, mstefank, msvehla, nmoumoul, nwallace, orabin, pantinor, pcongius, pcreech, pdelbell, pdrozd, peholase, pgallagh, pjindal, pmackay, pskopek, rchan, rguimara, rhuss, rjohnson, rkieley, rowaters, rruss, rstancel, skontopo, smaestri, sthorger, swoodman, tcunning, tom.jenkinson, yfang |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | jetty-server 9.4.51,jetty-server 10.0.14,jetty-server 11.0.14 | Doc Type: | --- |
| Doc Text: |
A flaw was found in the jetty-server package. A servlet with multipart support could get an OutOfMemorryError when the client sends a part that has a name but no filename and substantial content. This flaw allows a malicious user to jeopardize the environment by leaving the JVM in an unreliable state.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2238955, 2236676, 2236677, 2236678 | ||
| Bug Blocks: | 2187890 | ||
|
Description
Patrick Del Bello
2023-08-31 00:42:20 UTC
This issue has been addressed in the following products: Red Hat AMQ Streams 2.5.0 Via RHSA-2023:5165 https://access.redhat.com/errata/RHSA-2023:5165 This issue has been addressed in the following products: RHINT Camel-Springboot 4.0.0 Via RHSA-2023:5441 https://access.redhat.com/errata/RHSA-2023:5441 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Via RHSA-2023:7639 https://access.redhat.com/errata/RHSA-2023:7639 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Via RHSA-2023:7637 https://access.redhat.com/errata/RHSA-2023:7637 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Via RHSA-2023:7638 https://access.redhat.com/errata/RHSA-2023:7638 This issue has been addressed in the following products: EAP 7.4.14 Via RHSA-2023:7641 https://access.redhat.com/errata/RHSA-2023:7641 This issue has been addressed in the following products: OpenShift Developer Tools and Services for OCP 4.12 Via RHSA-2024:0778 https://access.redhat.com/errata/RHSA-2024:0778 This issue has been addressed in the following products: Red Hat Single Sign-On 7.6 for RHEL 8 Via RHSA-2024:0799 https://access.redhat.com/errata/RHSA-2024:0799 This issue has been addressed in the following products: Red Hat Single Sign-On 7.6 for RHEL 9 Via RHSA-2024:0800 https://access.redhat.com/errata/RHSA-2024:0800 This issue has been addressed in the following products: Red Hat Single Sign-On 7.6 for RHEL 7 Via RHSA-2024:0798 https://access.redhat.com/errata/RHSA-2024:0798 This issue has been addressed in the following products: RHEL-8 based Middleware Containers Via RHSA-2024:0801 https://access.redhat.com/errata/RHSA-2024:0801 This issue has been addressed in the following products: Red Hat Single Sign-On Via RHSA-2024:0804 https://access.redhat.com/errata/RHSA-2024:0804 Marking EAP-8 as not affected because EAP 8 GA was released with the fixed version. This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2024:3385 https://access.redhat.com/errata/RHSA-2024:3385 |