GHSA-4g42-gqrg-4633
Apache Struts vulnerable to memory exhaustion
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.struts:struts2-core | < 2.5.31 | 2.5.31 |
| Maven | org.apache.struts:struts2-core | >= 6.0.0, < 6.1.2.1 | 6.1.2.1 |
| Maven | org.apache.struts:struts-core | <= 1.3.10 | no fix listed |
| Maven | struts:struts | <= 1.2.9 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Denial of service via out of memory (OOM) owing to no sanity limit on normal form fields in multipart forms. When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to an OOM if developer has set struts.multipart.maxSize to a value equal or greater than the available memory.
Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2023-34396
- https://github.com/apache/struts/commit/2d6f1bc0a6f5ac575a56784ac6461816b67c4f21
- https://cwiki.apache.org/confluence/display/WW/S2-064
- https://github.com/apache/struts
- https://github.com/apache/struts/releases/tag/STRUTS_2_5_31
- https://github.com/apache/struts/releases/tag/STRUTS_6_1_2_1
- https://security.netapp.com/advisory/ntap-20230706-0005
- http://www.openwall.com/lists/oss-security/2023/06/14/3