A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2023:5484 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:5485 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:5486 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:5488 | Vendor Advisory |
| https://access.redhat.com/security/cve/CVE-2023-3171 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2213639 | Issue Tracking |
| https://access.redhat.com/errata/RHSA-2023:5484 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:5485 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:5486 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:5488 | Vendor Advisory |
| https://access.redhat.com/security/cve/CVE-2023-3171 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2213639 | Issue Tracking |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
|
History
21 Nov 2024, 08:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/errata/RHSA-2023:5484 - Vendor Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2023:5485 - Vendor Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2023:5486 - Vendor Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2023:5488 - Vendor Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2023-3171 - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2213639 - Issue Tracking |
04 Jan 2024, 17:07
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-770 | |
| First Time |
Redhat
Redhat jboss Enterprise Application Platform Redhat enterprise Linux |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* |
|
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2213639 - Issue Tracking | |
| References | () https://access.redhat.com/errata/RHSA-2023:5486 - Vendor Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2023:5484 - Vendor Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2023:5488 - Vendor Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2023-3171 - Vendor Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2023:5485 - Vendor Advisory |
27 Dec 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-27 16:15
Updated : 2024-11-21 08:16
NVD link : CVE-2023-3171
Mitre link : CVE-2023-3171
CVE.ORG link : CVE-2023-3171
JSON object : View
Products Affected
redhat
- jboss_enterprise_application_platform
- enterprise_linux