CVE Vulnerabilities

CVE-2023-3171

Memory Allocation with Excessive Size Value

Published: Dec 27, 2023 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
7.5 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu

A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.

Weakness

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Affected Software

Name Vendor Start Version End Version
Jboss_enterprise_application_platform Redhat 7.4 (including) 7.4 (including)
EAP 7.4.13 RedHat server *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-apache-cxf-0:3.4.10-1.SP1_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-avro-0:1.7.6-8.redhat_00003.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-h2database-0:1.4.197-3.redhat_00004.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-jboss-annotations-api_1.3_spec-0:2.0.1-4.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-jboss-server-migration-0:1.7.2-12.Final_redhat_00013.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-jboss-xnio-base-0:3.7.13-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-log4j-jboss-logmanager-0:1.2.2-2.Final_redhat_00002.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-wildfly-0:7.3.11-4.GA_redhat_00002.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-wss4j-0:2.3.3-2.redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-xalan-j2-0:2.7.1-38.redhat_00015.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-xml-security-0:2.2.3-2.redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-activemq-artemis-0:2.16.0-15.redhat_00049.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-bouncycastle-0:1.76.0-4.redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-hal-console-0:3.3.19-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-hibernate-0:5.3.31-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-ironjacamar-0:1.5.15-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-jboss-marshalling-0:2.0.13-2.SP1_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-jboss-modules-0:1.12.2-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-jboss-server-migration-0:1.10.0-31.Final_redhat_00030.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-jboss-xnio-base-0:3.8.10-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-mod_cluster-0:1.4.5-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-netty-0:4.1.94-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-netty-transport-native-epoll-0:4.1.94-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-resteasy-0:3.15.8-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-undertow-0:2.2.26-1.SP1_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-wildfly-0:7.4.13-8.GA_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-wildfly-elytron-0:1.15.20-1.Final_redhat_00001.1.el7eap *

Potential Mitigations

References