Vulnerability · Published Dec 27, 2023 · Assigned by redhat
CVE-2023-3171Eap-7: heap exhaustion via deserialization
High 7.5
In plain English
A high-severity security flaw in EAP 7.4.13 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.0%top 36.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.
Affected products (as reported)
Weakness: CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- RHSA-2023:5484 vendor-advisory, x_refsource_REDHAT
- RHSA-2023:5485 vendor-advisory, x_refsource_REDHAT
- RHSA-2023:5486 vendor-advisory, x_refsource_REDHAT
- RHSA-2023:5488 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-3171 vdb-entry, x_refsource_REDHAT
- RHBZ#2213639 issue-tracking, x_refsource_REDHAT