CVE-2023-3171
HIGH severity · CVSS 7.5 · CWE-789
7.5CVSS HIGH
Summary
A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
Confidentiality impactNone
Integrity impactNone
Availability impactHigh
Exploit probability (EPSS)1%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Additional information
- NVD record
- https://access.redhat.com/errata/RHSA-2023:5484Advisory
- https://access.redhat.com/errata/RHSA-2023:5485Advisory
- https://access.redhat.com/errata/RHSA-2023:5486Advisory
- https://access.redhat.com/errata/RHSA-2023:5488Advisory
- https://access.redhat.com/security/cve/CVE-2023-3171Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2213639