CVE-2023-1973

Description

A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory.

Reserved 2023-04-10 | Published 2024-11-07 | Updated 2024-11-07 | Assigner redhat

Problem types

Improper Input Validation

Product status

Default status
unaffected

Default status
affected

0:2.2.30-1.SP1_redhat_00001.1.el8eap before *
unaffected

Default status
affected

0:2.2.30-1.SP1_redhat_00001.1.el9eap before *
unaffected

Default status
affected

0:2.2.30-1.SP1_redhat_00001.1.el7eap before *
unaffected

Default status
unaffected

Default status
affected

0:2.3.11-1.SP1_redhat_00001.1.el8eap before *
unaffected

Default status
affected

0:2.3.11-1.SP1_redhat_00001.1.el9eap before *
unaffected

Timeline

2023-02-20:	Reported to Red Hat.
2024-04-04:	Made public.

References

access.redhat.com/errata/RHSA-2024:1674 (RHSA-2024:1674) vendor-advisory

access.redhat.com/errata/RHSA-2024:1675 (RHSA-2024:1675) vendor-advisory

access.redhat.com/errata/RHSA-2024:1676 (RHSA-2024:1676) vendor-advisory

access.redhat.com/errata/RHSA-2024:1677 (RHSA-2024:1677) vendor-advisory

access.redhat.com/errata/RHSA-2024:2763 (RHSA-2024:2763) vendor-advisory

access.redhat.com/errata/RHSA-2024:2764 (RHSA-2024:2764) vendor-advisory

access.redhat.com/security/cve/CVE-2023-1973 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2185662 (RHBZ#2185662) issue-tracking

cve.org (CVE-2023-1973)

nvd.nist.gov (CVE-2023-1973)

Download JSON