CVE-2023-3171

A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.

CVSS v3.0 7.5 HIGH

7.5^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2023:5484	Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5485	Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5486	Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5488	Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-3171	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2213639	Issue Tracking

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*

OR	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*

Configuration 2 (hide)

cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*

Information

Published : 2023-12-27 16:15

Updated : 2024-01-04 17:07

NVD link : CVE-2023-3171

Mitre link : CVE-2023-3171

JSON object : View

Products Affected

redhat

enterprise_linux
jboss_enterprise_application_platform

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://access.redhat.com/errata/RHSA-2023:5484", "name": "RHSA-2023:5484", "tags": ["Vendor Advisory"], "refsource": ""}, {"url": "https://access.redhat.com/errata/RHSA-2023:5485", "name": "RHSA-2023:5485", "tags": ["Vendor Advisory"], "refsource": ""}, {"url": "https://access.redhat.com/errata/RHSA-2023:5486", "name": "RHSA-2023:5486", "tags": ["Vendor Advisory"], "refsource": ""}, {"url": "https://access.redhat.com/errata/RHSA-2023:5488", "name": "RHSA-2023:5488", "tags": ["Vendor Advisory"], "refsource": ""}, {"url": "https://access.redhat.com/security/cve/CVE-2023-3171", "name": "https://access.redhat.com/security/cve/CVE-2023-3171", "tags": ["Vendor Advisory"], "refsource": ""}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2213639", "name": "RHBZ#2213639", "tags": ["Issue Tracking"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-770"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2023-3171", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}}, "publishedDate": "2023-12-27T16:15Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2024-01-04T17:07Z"}