Allocation of Resources Without Limits or Throttling Affecting pki-servlet-engine package, versions *


Severity

Recommended
0.0
medium
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
1.6% (88th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RHEL9-PKISERVLETENGINE-5660788
  • published28 Feb 2023
  • disclosed20 Feb 2023

Introduced: 20 Feb 2023

CVE-2023-24998  (opens in a new tab)
CWE-770  (opens in a new tab)

How to fix?

There is no fixed version for RHEL:9 pki-servlet-engine.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pki-servlet-engine package and not the pki-servlet-engine package as distributed by RHEL. See How to fix? for RHEL:9 relevant fixed versions and status.

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.

Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

CVSS Scores

version 3.1