Red Hat: CVE-2023-24998: Apache Commons FileUpload: FileUpload DoS with excessive parts (Multiple Advisories)

Red Hat: CVE-2023-24998: Apache Commons FileUpload: FileUpload DoS with excessive parts (Multiple Advisories)

Severity

8

CVSS

(AV:N/AC:L/Au:N/C:N/I:N/A:C)

Published

02/20/2023

Created

11/09/2023

Added

11/08/2023

Modified

01/28/2025

Description

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

Solution(s)

• redhat-upgrade-tomcat
• redhat-upgrade-tomcat-admin-webapps
• redhat-upgrade-tomcat-docs-webapp
• redhat-upgrade-tomcat-el-3-0-api
• redhat-upgrade-tomcat-jsp-2-3-api
• redhat-upgrade-tomcat-lib
• redhat-upgrade-tomcat-servlet-4-0-api
• redhat-upgrade-tomcat-webapps

References

• CVE-2023-24998
• RHSA-2023:6570
• RHSA-2023:7065