Database Performance Analyzer (DPA) and a potential denial of service attack: CVE-2023-24998 and CVE-2023-28709

In 2023, the National Institute of Standards and Technology (NIST) published the following security bulletins about vulnerabilities that could potentially result in a denial of service (DOS) attack:

• CVE-2023-24988 (© 2023 National Institute of Standards and Technology, available at nvd.nist.gov, obtained on September 25, 2023)

  Because Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed, an attacker could trigger a DOS attack with a malicious upload. Version 1.5 provides a configuration option (FileUploadBase#setFileCountMax) to limit the maximum number of files allowed per upload request. However, this option is not enabled by default and must be configured.

• CVE-2023-28709 (© 2023 National Institute of Standards and Technology, available at nvd.nist.gov, obtained on September 25, 2023)

  The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. Under specific circumstances, the limit for uploaded requests parts could be bypassed.

CVE-2023-24998 and CVE-2023-28709

All supported versions of DPA either use a version of Apache Commons FileUpload that does not include the FileUploadBase#setFileCountMax configuration option, or that configuration option is not enabled. Additionally, all supported versions of DPA include the affected version of Apache Tomcat. However, these vulnerabilities do not apply to DPA because DPA does not provide the option of uploading multiple files.