title: Outofmemoryerror due to @multipartconfig handling
description: A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
problem types: Memory Allocation with Excessive Size Value
affected:
{
product: undertow
vendor: n/a
versions:
version: 2.2.24, status: unaffected
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
defaultStatus: unaffected
packageName: undertow
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow
defaultStatus: affected
versions:
version: 0:2.2.25-3.SP3_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow
defaultStatus: affected
versions:
version: 0:2.2.25-3.SP3_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow
defaultStatus: affected
versions:
version: 0:2.2.25-3.SP3_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
defaultStatus: unaffected
packageName: undertow
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6.5
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.9-1.redhat_00001.1.el7sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.9-1.redhat_00001.1.el8sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.9-1.redhat_00001.1.el9sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
}
{
vendor: Red Hat
product: RHEL-8 based Middleware Containers
collectionURL: https://catalog.redhat.com/software/containers/
packageName: rh-sso-7/sso76-openshift-rhel8
defaultStatus: affected
versions:
version: 7.6-27, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:rhosemc:1.0::el8
}
{
vendor: Red Hat
product: Red Hat build of Quarkus
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unaffected
cpes: cpe:/a:redhat:quarkus:2
}
{
vendor: Red Hat
product: Red Hat Data Grid 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unaffected
cpes: cpe:/a:redhat:jboss_data_grid:8
}
{
vendor: Red Hat
product: Red Hat Decision Manager 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: affected
cpes: cpe:/a:redhat:jboss_enterprise_brms_platform:7
}
{
vendor: Red Hat
product: Red Hat Integration Camel K
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: affected
cpes: cpe:/a:redhat:integration:1
}
{
vendor: Red Hat
product: Red Hat Integration Service Registry
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: affected
cpes: cpe:/a:redhat:service_registry:2
}
{
vendor: Red Hat
product: Red Hat JBoss Data Grid 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_data_grid:7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: undertow
defaultStatus: unaffected
cpes: cpe:/a:redhat:jbosseapxp
}
{
vendor: Red Hat
product: Red Hat JBoss Fuse 6
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_fuse:6
}
{
vendor: Red Hat
product: Red Hat JBoss Fuse 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: undertow
defaultStatus: affected
cpes: cpe:/a:redhat:jboss_fuse:7
}
{
vendor: Red Hat
product: Red Hat OpenStack Platform 13 (Queens) Operational Tools
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:openstack-optools:13
}
{
vendor: Red Hat
product: Red Hat Process Automation 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: affected
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
}
{
vendor: Red Hat
product: Red Hat support for Spring Boot
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unaffected
cpes: cpe:/a:redhat:openshift_application_runtimes:1.0
}
metrics:
other: [
content: {'value': 'Important', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]