CVE-2023-3171

A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*
OR cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*

History

21 Nov 2024, 08:16

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2023:5484 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:5484 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:5485 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:5485 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:5486 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:5486 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:5488 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:5488 - Vendor Advisory
References () https://access.redhat.com/security/cve/CVE-2023-3171 - Vendor Advisory () https://access.redhat.com/security/cve/CVE-2023-3171 - Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2213639 - Issue Tracking () https://bugzilla.redhat.com/show_bug.cgi?id=2213639 - Issue Tracking

04 Jan 2024, 17:07

Type Values Removed Values Added
CWE CWE-770
First Time Redhat
Redhat jboss Enterprise Application Platform
Redhat enterprise Linux
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5
CPE cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
References () https://bugzilla.redhat.com/show_bug.cgi?id=2213639 - () https://bugzilla.redhat.com/show_bug.cgi?id=2213639 - Issue Tracking
References () https://access.redhat.com/errata/RHSA-2023:5486 - () https://access.redhat.com/errata/RHSA-2023:5486 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:5484 - () https://access.redhat.com/errata/RHSA-2023:5484 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:5488 - () https://access.redhat.com/errata/RHSA-2023:5488 - Vendor Advisory
References () https://access.redhat.com/security/cve/CVE-2023-3171 - () https://access.redhat.com/security/cve/CVE-2023-3171 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:5485 - () https://access.redhat.com/errata/RHSA-2023:5485 - Vendor Advisory

27 Dec 2023, 16:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-12-27 16:15

Updated : 2024-11-21 08:16


NVD link : CVE-2023-3171

Mitre link : CVE-2023-3171

CVE.ORG link : CVE-2023-3171


JSON object : View

Products Affected

redhat

  • jboss_enterprise_application_platform
  • enterprise_linux
CWE
CWE-789

Memory Allocation with Excessive Size Value

CWE-770

Allocation of Resources Without Limits or Throttling